Bad code path in DoSyscall
john.whitney at timesys.com
Tue Nov 11 02:56:08 EST 2003
There seems to be a bad code path in the assembly routine DoSyscall()
(arch/ppc/kernel/entry.S). In the case of an invalid syscall being made (in
my case, from user space), DoSyscall is called and eventually branches to
label 66. Note that before the branch, r12 is set to zero.
lwz r11,_CCR(r1) /* Clear SO bit in CR */
#endif /* SHOW_SYSCALLS */
Code at label 66 sets ENOSYS, and branches to label 22.
66: li r3,ENOSYS
Code after label 22 presumes that r12 is set to the current thread, and
tries to access off of it:
22: lwz r10,_CCR(r1) /* Set SO bit in CR */
/* disable interrupts so current_thread_info()->flags can't change */
30: LOAD_MSR_KERNEL(r10,MSR_KERNEL) /* doesn't include MSR_EE */
Which immediately causes a bad page fault kernel oops. I haven't come up
with a patch yet, but will try to when I get the time unless someone with
more knowledge in this area wants to do it. Just wanted to let the list
know about the problem.
** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/
More information about the Linuxppc-dev