ppc64 sys_ipc breakage in 2.6.34-rc2

Anton Blanchard anton at samba.org
Mon Mar 22 17:47:59 EST 2010


I chased down a fail on ppc64 on 2.6.34-rc2 where an application that uses
shared memory was getting a SEGV.

Commit baed7fc9b580bd3fb8252ff1d9b36eaf1f86b670 (Add generic sys_ipc wrapper)
changed the second argument from an unsigned long to an int. When we call
shmget the system call wrappers for sys_ipc will sign extend second (ie the
size) which truncates it. It took a while to track down because the call
succeeds and strace shows the untruncated size :)

The patch below changes second from an int to an unsigned long which fixes
shmget on ppc64 (and I assume s390, sparc64 and mips64).

Signed-off-by: Anton Blanchard <anton at samba.org>
--

I assume the function prototypes for the other IPC methods would cause us
to sign or zero extend second where appropriate (avoiding any security
issues). Come to think of it, the syscall wrappers for each method should do
that for us as well.

diff --git a/ipc/syscall.c b/ipc/syscall.c
index 355a3da..1d6f53f 100644
--- a/ipc/syscall.c
+++ b/ipc/syscall.c
@@ -13,7 +13,7 @@
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
 
-SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, int, second,
+SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
 		unsigned long, third, void __user *, ptr, long, fifth)
 {
 	int version, ret;


More information about the Linuxppc-dev mailing list