Home » Mailing list archives » linux-kernel » 2008 » October » 2

Re: [PATCH] rtc: fix kernel panic on second use of SIGIO nofitication

Previous thread: [PATCH] x86: smpboot - check if we have ESR register in wakeup_secondary_cpu by Cyrill Gorcunov on Sunday, September 14, 2008 - 10:58 am. (5 messages)

Next thread: [RFC PATCH] Script for generating Documentation/dontdiff from .gitignore files. by Eduard - Gabriel Munteanu on Sunday, September 14, 2008 - 11:23 am. (3 messages)
[view original message]
From: Marcin Slusarz
Subject: [PATCH] rtc: fix kernel panic on second use of SIGIO nofitication
Date: Sunday, September 14, 2008 - 11:11 am

When user space uses SIGIO notification and forgets to disable it before
closing file descriptor, rtc->async_queue contains stale pointer to struct
file. When user space enables again SIGIO notification in different process,
kernel dereferences this (poisoned) pointer and crashes.

So disable SIGIO notification on close.

Kernel panic:
(second run of qemu (requires echo 1024 > /sys/class/rtc/rtc0/max_user_freq))

general protection fault: 0000 [1] PREEMPT
CPU 0
Modules linked in: af_packet snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq usbhid tuner tea5767 tda8290 tuner_xc2028 xc5000 tda9887 tuner_simple tuner_types mt20xx tea5761 tda9875 uhci_hcd ehci_hcd usbcore bttv snd_via82xx snd_ac97_codec ac97_bus snd_pcm snd_timer ir_common compat_ioctl32 snd_page_alloc videodev v4l1_compat snd_mpu401_uart snd_rawmidi v4l2_common videobuf_dma_sg videobuf_core snd_seq_device snd btcx_risc soundcore tveeprom i2c_viapro
Pid: 5781, comm: qemu-system-x86 Not tainted 2.6.27-rc6 #363
RIP: 0010:[<ffffffff8024f891>]  [<ffffffff8024f891>] __lock_acquire+0x3db/0x73f
RSP: 0000:ffffffff80674cb8  EFLAGS: 00010002
RAX: ffff8800224c62f0 RBX: 0000000000000046 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800224c62f0
RBP: ffffffff80674d08 R08: 0000000000000002 R09: 0000000000000001
R10: ffffffff80238941 R11: 0000000000000001 R12: 0000000000000000
R13: 6b6b6b6b6b6b6b6b R14: ffff88003a450080 R15: 0000000000000000
FS:  00007f98b69516f0(0000) GS:ffffffff80623200(0000) knlGS:00000000f7cc86d0
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000a87000 CR3: 0000000022598000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process qemu-system-x86 (pid: 5781, threadinfo ffff880028812000, task ffff88003a450080)
Stack:  ffffffff80674cf8 0000000180238440 0000000200000002 0000000000000000
 ffff8800224c62f0 0000000000000046 0000000000000000 0000000000000002
 ...
[ message continues ]
[view original message]
From: Andrew Morton
Subject: Re: [PATCH] rtc: fix kernel panic on second use of SIGIO nofitication
Date: Thursday, October 2, 2008 - 2:49 pm

On Sun, 14 Sep 2008 20:11:27 +0200

David, Alessandro: can we please have a review-n-ack of this one for
2.6.27 and earlier?  

Thanks.

From: Marcin Slusarz <marcin.slusarz@gmail.com>

When userspace uses SIGIO notification and forgets to disable it before
closing file descriptor, rtc->async_queue contains stale pointer to struct
file.  When user space enables again SIGIO notification in different
process, kernel dereferences this (poisoned) pointer and crashes.

So disable SIGIO notification on close.

Kernel panic:
(second run of qemu (requires echo 1024 > /sys/class/rtc/rtc0/max_user_freq))

general protection fault: 0000 [1] PREEMPT
CPU 0
Modules linked in: af_packet snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq usbhid tuner tea5767 tda8290 tuner_xc2028 xc5000 tda9887 tuner_simple tuner_types mt20xx tea5761 tda9875 uhci_hcd ehci_hcd usbcore bttv snd_via82xx snd_ac97_codec ac97_bus snd_pcm snd_timer ir_common compat_ioctl32 snd_page_alloc videodev v4l1_compat snd_mpu401_uart snd_rawmidi v4l2_common videobuf_dma_sg videobuf_core snd_seq_device snd btcx_risc soundcore tveeprom i2c_viapro
Pid: 5781, comm: qemu-system-x86 Not tainted 2.6.27-rc6 #363
RIP: 0010:[<ffffffff8024f891>]  [<ffffffff8024f891>] __lock_acquire+0x3db/0x73f
RSP: 0000:ffffffff80674cb8  EFLAGS: 00010002
RAX: ffff8800224c62f0 RBX: 0000000000000046 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800224c62f0
RBP: ffffffff80674d08 R08: 0000000000000002 R09: 0000000000000001
R10: ffffffff80238941 R11: 0000000000000001 R12: 0000000000000000
R13: 6b6b6b6b6b6b6b6b R14: ffff88003a450080 R15: 0000000000000000
FS:  00007f98b69516f0(0000) GS:ffffffff80623200(0000) knlGS:00000000f7cc86d0
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000a87000 CR3: 0000000022598000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process qemu-system-x86 (pid: 5781, ...
[ message continues ]
[view original message]
From: Alessandro Zummo
Subject: Re: [PATCH] rtc: fix kernel panic on second use of SIGIO nofitication
Date: Thursday, October 2, 2008 - 3:12 pm

On Thu, 2 Oct 2008 14:49:41 -0700


 
 Acked-by: Alessandro Zummo <a.zummo@towertech.it>

-- 

 Best regards,

 Alessandro Zummo,
  Tower Technologies - Torino, Italy

  http://www.towertech.it

--


[ message continues ]
[view original message]
From: David Brownell
Subject: Re: [PATCH] rtc: fix kernel panic on second use of SIGIO nofitication
Date: Thursday, October 2, 2008 - 4:44 pm

Acked-by: David Brownell <dbrownell@users.sourceforge.net>

Seemed "obviously good" anti-oops medicine to me, then I double
checked against some code that is AFAIK still correct..
--


[ message continues ]
Previous thread: [PATCH] x86: smpboot - check if we have ESR register in wakeup_secondary_cpu by Cyrill Gorcunov on Sunday, September 14, 2008 - 10:58 am. (5 messages)

Next thread: [RFC PATCH] Script for generating Documentation/dontdiff from .gitignore files. by Eduard - Gabriel Munteanu on Sunday, September 14, 2008 - 11:23 am. (3 messages)