Messages in this thread | | | From | David Brownell <> | Subject | Re: [PATCH] rtc: fix kernel panic on second use of SIGIO nofitication | Date | Thu, 2 Oct 2008 16:44:51 -0700 |
| |
On Thursday 02 October 2008, Alessandro Zummo wrote: > On Thu, 2 Oct 2008 14:49:41 -0700 > Andrew Morton <akpm@linux-foundation.org> wrote: > > > On Sun, 14 Sep 2008 20:11:27 +0200 > > Marcin Slusarz <marcin.slusarz@gmail.com> wrote: > > > > > When user space uses SIGIO notification and forgets to disable it before > > > closing file descriptor, rtc->async_queue contains stale pointer to struct > > > file. When user space enables again SIGIO notification in different process, > > > kernel dereferences this (poisoned) pointer and crashes. > > > > > > So disable SIGIO notification on close. > > > > > > > David, Alessandro: can we please have a review-n-ack of this one for > > 2.6.27 and earlier? > > > > Thanks. > > > > From: Marcin Slusarz <marcin.slusarz@gmail.com> > > > > When userspace uses SIGIO notification and forgets to disable it before > > closing file descriptor, rtc->async_queue contains stale pointer to struct > > file. When user space enables again SIGIO notification in different > > process, kernel dereferences this (poisoned) pointer and crashes. > > > > So disable SIGIO notification on close. > > [...] > > > > Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com> > > Cc: Alessandro Zummo <alessandro.zummo@towertech.it> > > Cc: David Brownell <dbrownell@users.sourceforge.net> > > Cc: <stable@kernel.org> > > Signed-off-by: Andrew Morton <akpm@linux-foundation.org> > > > Acked-by: Alessandro Zummo <a.zummo@towertech.it>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Seemed "obviously good" anti-oops medicine to me, then I double checked against some code that is AFAIK still correct..
| |