| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 9 May 2016 08:39:03 +0200
From: Waldemar Brodkorb <wbx@...nadk.org>
To: linux-kernel@...r.kernel.org
Cc: Denys Vlasenko <vda.linux@...glemail.com>,
Thomas Petazzoni <thomas.petazzoni@...e-electrons.com>,
Gustavo Zacarias <gustavo@...arias.com.ar>
Subject: qemu m68k/mcf5208: problem with signal handler
Dear kernel hackers,
I have a problem with the signal handling under qemu-system-m68k
emulating coldfire mcf5208 evalboard. Following example code
provided by Busybox maintainer Denys Vlasenko
shows the problem when running on qemu:
#include <unistd.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/wait.h>
static void sighandler(int sig)
{
write(1, "SIGNAL\n", 7);
}
int main()
{
int pid;
write(1, "VFORK1\n", 7);
pid = vfork();
if (pid == 0) {
write(1, "EXIT1\n", 6);
_exit(1);
}
wait(NULL);
signal(SIGCHLD, sighandler);
write(1, "VFORK2\n", 7);
pid = vfork();
if (pid == 0) {
write(1, "EXIT2\n", 6);
_exit(1);
}
wait(NULL);
write(1, "EXIT\n", 5);
return 0;
}
You can generate a bootable image with latest buildroot, which shows the issue:
$ git clone git://git.buildroot.net/buildroot
$ cd buildroot; make qemu_m68k_mcf5208_defconfig; make
$ qemu-system-m68k -M mcf5208evb -cpu m5208 -kernel output/images/vmlinux -nographic
Every command forked from busybox hush shell will lead into a segmentation fault.
I added following printk to start investigating the problem:
diff -Nur linux-4.5.3.orig/arch/m68k/kernel/signal.c linux-4.5.3/arch/m68k/kernel/signal.c
--- linux-4.5.3.orig/arch/m68k/kernel/signal.c 2016-05-04 23:50:38.000000000 +0200
+++ linux-4.5.3/arch/m68k/kernel/signal.c 2016-05-09 04:24:53.885199544 +0200
@@ -595,6 +595,7 @@
void __user *fp)
{
int fsize = frame_extra_sizes(formatvec >> 12);
+ printk("avoid broken signal handler...\n");
if (fsize < 0) {
/*
* user process trying to return with weird frame format
But now the problem disappeared. :/
What do you think? Is it a Kernel bug or a C library problem?
Busybox hush otherwise works fine for other noMMU targets as stm32
evalboard with cortex-m4. It also works in Qemu M68k emulating Q800
full MMU system.
Thanks for any ideas,
Waldemar
http://lists.busybox.net/pipermail/busybox/2014-September/081659.html
Powered by blists - more mailing lists