lkml.org 
[lkml]   [1997]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectProblems in tty_ioctl?
Hello, Kernel Hackers!

I am using kernel version 2.1.76. Today, I tried a program called
9term (it's a terminal emulator for X) and wondered why did it exit
right after pressing a key. To my amusement, the program died because
of an oops (attached, but looks weird). The kernel stumbled in
tty_ioctl().

The following patch cures the problem, but probably not the cause:

[cut here]
--- /usr/src/linux/drivers/char/tty_io.c- Sat Dec 27 19:29:29 1997
+++ /usr/src/linux/drivers/char/tty_io.c Sat Dec 27 19:52:54 1997
@@ -1548,13 +1548,17 @@
switch(cmd) {
case TIOCSBRK:
case TIOCCBRK:
- return tty->driver.ioctl(tty, file, cmd, arg);
+ if (tty->driver.ioctl)
+ return tty->driver.ioctl(tty, file, cmd, arg);
+ return -ENOIOCTLCMD;

/* These two ioctl's always return success; even if */
/* the driver doesn't support them. */
case TCSBRK:
- case TCSBRKP:
- retval = tty->driver.ioctl(tty, file, cmd, arg);
+ case TCSBRKP:
+ retval = 0;
+ if (tty->driver.ioctl)
+ retval = tty->driver.ioctl(tty, file, cmd, arg);
if (retval == -ENOIOCTLCMD)
retval = 0;
return retval;
[cut here]
The oops was triggered because tty->driver.ioctl was a NULL pointer
(the ptys don't have driver.ioctl?). This makes me wonder what would
be the right fix? Should ptys have ioctl()? A simple one would do
pretty well:

pty_driver_ioctl(...)
{
return -ENOIOCTLCMD;
}
Or some such... But clearly the current behavior is broken, since an
usermode program reproducibly triggers an oops...

(BTW, what use is 9term? Couldn't think of any...)


Taneli <vahakang@cs.helsinki.fi>
Oops: 0000
CPU: 0
EIP: 0010:[<00000000>]
EFLAGS: 00010246
eax: 00000000 ebx: c2ec5000 ecx: c30a58a0 edx: c0173f84
esi: 00000001 edi: c2ec1000 ebp: 00005409 esp: c240df78
ds: 0018 es: 0018 ss: 0018
Process 9term (pid: 1544, process nr: 42, stackpage=c240d000)
Stack: c017406d c2ec5000 c30a58a0 00005409 00000001 00005409 c30a58a0 00000001
00000004 c012c312 c2dc8b70 c30a58a0 00005409 00000001 c240c000 bffffc0c
bffffda8 bffffbf4 c0109956 00000004 00005409 00000001 bffffc0c bffffda8
Call Trace: [<c017406d>] [<c012c312>] [<c0109956>]
Code: <1>Unable to handle kernel NULL pointer dereference at virtual address 00000000
Oops: 0000
CPU: 0
EIP: 0010:[<c0109dc2>]
EFLAGS: 00010086
eax: 00000010 ebx: 0000002b ecx: 00000000 edx: 00000010
esi: 00000000 edi: c240e000 ebp: c240df44 esp: c240ded0
ds: 0018 es: 0018 ss: 0018
Process 9term (pid: 1544, process nr: 42, stackpage=c240d000)
Stack: 0000002b c240df44 00000000 00000000 c357b540 c4800000 c5000000 c4800000
c01b0018 c0109e3c c240df44 c0187c3f c0188937 00000000 00000000 c010e696
c0188937 c240df44 00000000 c240c000 00000001 c2ec1000 00005409 08048000
Call Trace: [<c4800000>] [<c5000000>] [<c4800000>] [<c0109e3c>] [<c0187c3f>] [<c0188937>] [<c010e696>]
[<c0188937>] [<c0109a92>] [<c0173f84>] [<c017406d>] [<c012c312>] [<c0109956>]
Code: 64 8a 04 0e 0f a1 88 c2 81 e2 ff 00 00 00 89 54 24 10 52 68

Using `/usr/src/linux/System.map' to map addresses to symbols.

>>EIP: 0 cannot be resolved
Trace: c017406d <tty_ioctl+e9/468>
Trace: c012c312 <sys_ioctl+14e/164>
Trace: c0109956 <system_call+3a/40>
Code:
>>EIP: c0109dc2 <show_registers+21a/258>
Trace: c4800000
Trace: c5000000
Trace: c4800000
Trace: c0109e3c <die_if_kernel+3c/48>
Trace: c0187c3f <sprintf+21d3/2c49>
Trace: c0188937 <bad_pmd_string+282/317>
Trace: c010e696 <do_page_fault+32a/33c>
Trace: c0188937 <bad_pmd_string+282/317>
Trace: c0109a92 <error_code+32/3c>
Trace: c017406d <tty_ioctl+e9/468>
Trace: c017406d <tty_ioctl+e9/468>
Trace: c012c312 <sys_ioctl+14e/164>
Trace: c0109956 <system_call+3a/40>
Code: c0109dc2 <show_registers+21a/258>
Code: c0109dc2 <show_registers+21a/258> 64 8a 04 0e movb %fs:(%esi,%ecx,1),%al
Code: c0109dc6 <show_registers+21e/258> 0f a1 popl %fs
Code: c0109dc8 <show_registers+220/258> 88 c2 movb %al,%dl
Code: c0109dca <show_registers+222/258> 81 e2 ff 00 00 andl $0xff,%edx
Code: c0109dd6 <show_registers+22e/258> 89 54 24 10 movl %edx,0x10(%esp,1)
Code: c0109dda <show_registers+232/258> 52 pushl %edx
Code: c0109ddb <show_registers+233/258> 68 00 90 90 90 pushl $0x90909000
\
 
 \ /
  Last update: 2005-03-22 13:40    [W:0.069 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site