lkml.org 
[lkml]   [2005]   [Sep]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Security] [vendor-sec] [BUG/PATCH/RFC] Oops while completing async USB via usbdevio


On Sun, 25 Sep 2005, Harald Welte wrote:
>
> async_completed() calls send_sig_info(), which in turn does a
> spin_lock(&tasklist_lock) to protect itself from task_struct->sighand
> from going away. However, the call to
> "spin_lock_irqsave(task_struct->sighand->siglock)" causes an oops,
> because "sighand" has disappeared.

And the real bug is that you're buggering up the system in the first
place.

You don't save "current". You save "pid", and then you send a signal using
that and kill_proc_info(). End of story, bug gone. And it works with
threaded programs too, which the old thing didn't work at all with.

I refuse to apply this patch - Greg, don't even _try_ to sneak this in
through a git merge. What a horribly broken thing to do: why would USB
_ever_ need to know about things like tasklist_lock, and internal signal
handling functions and rules like "p->sighand"?

Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2009-11-18 23:46    [W:0.135 / U:0.084 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site