aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMikulas Patocka2018-01-02 13:01:34 -0600
committerGreg Kroah-Hartman2018-02-16 13:09:46 -0600
commitf6d7ea7a180177fcf5c0aabb45dc8e2503a5fd9e (patch)
tree94632ffc2ac328f9d9bd304b75cebe16e2d01b9e
parentfbc1425f4544371b5fe20b9a93f73b85c08dfe29 (diff)
downloadkernel-omap-f6d7ea7a180177fcf5c0aabb45dc8e2503a5fd9e.tar.gz
kernel-omap-f6d7ea7a180177fcf5c0aabb45dc8e2503a5fd9e.tar.xz
kernel-omap-f6d7ea7a180177fcf5c0aabb45dc8e2503a5fd9e.zip
alpha: fix crash if pthread_create races with signal delivery
commit 21ffceda1c8b3807615c40d440d7815e0c85d366 upstream. On alpha, a process will crash if it attempts to start a thread and a signal is delivered at the same time. The crash can be reproduced with this program: https://cygwin.com/ml/cygwin/2014-11/msg00473.html The reason for the crash is this: * we call the clone syscall * we go to the function copy_process * copy process calls copy_thread_tls, it is a wrapper around copy_thread * copy_thread sets the tls pointer: childti->pcb.unique = regs->r20 * copy_thread sets regs->r20 to zero * we go back to copy_process * copy process checks "if (signal_pending(current))" and returns -ERESTARTNOINTR * the clone syscall is restarted, but this time, regs->r20 is zero, so the new thread is created with zero tls pointer * the new thread crashes in start_thread when attempting to access tls The comment in the code says that setting the register r20 is some compatibility with OSF/1. But OSF/1 doesn't use the CLONE_SETTLS flag, so we don't have to zero r20 if CLONE_SETTLS is set. This patch fixes the bug by zeroing regs->r20 only if CLONE_SETTLS is not set. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--arch/alpha/kernel/process.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 84d13263ce46..8095fb2c5c94 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -273,12 +273,13 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
273 application calling fork. */ 273 application calling fork. */
274 if (clone_flags & CLONE_SETTLS) 274 if (clone_flags & CLONE_SETTLS)
275 childti->pcb.unique = regs->r20; 275 childti->pcb.unique = regs->r20;
276 else
277 regs->r20 = 0; /* OSF/1 has some strange fork() semantics. */
276 childti->pcb.usp = usp ?: rdusp(); 278 childti->pcb.usp = usp ?: rdusp();
277 *childregs = *regs; 279 *childregs = *regs;
278 childregs->r0 = 0; 280 childregs->r0 = 0;
279 childregs->r19 = 0; 281 childregs->r19 = 0;
280 childregs->r20 = 1; /* OSF/1 has some strange fork() semantics. */ 282 childregs->r20 = 1; /* OSF/1 has some strange fork() semantics. */
281 regs->r20 = 0;
282 stack = ((struct switch_stack *) regs) - 1; 283 stack = ((struct switch_stack *) regs) - 1;
283 *childstack = *stack; 284 *childstack = *stack;
284 childstack->r26 = (unsigned long) ret_from_fork; 285 childstack->r26 = (unsigned long) ret_from_fork;