Messages in this thread | | | Date | Wed, 21 May 2008 07:38:02 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] capabilities: fix sys_prctl() returned uninitialized value |
| |
Quoting Shi Weihua (shiwh@cn.fujitsu.com): > When we test kernel by the latest LTP(20080430) on ia64, > the following failure occured: > ------------------------------------- > prctl01 1 PASS : Test Passed > prctl01 0 WARN : prctl() returned 2048 errno = 0 : Success > prctl01 1 PASS : Test Passed > prctl01 2 FAIL : Test Failed > ------------------------------------- > > We found commit 3898b1b4ebff8dcfbcf1807e0661585e06c9a91c > causes this failure by git-bisect. > And, we found *rc_p has not been initialized if switch-default > of the function cap_task_prctl()(security/commoncap.c). When *rc_p > uninitialized, sys_prctl() will return a wrong value. > > Signed-off-by: Shi Weihua <shiwh@cn.fujitsu.com> > --- > diff --git a/security/commoncap.c b/security/commoncap.c > index 5edabc7..a4b28c8 100644 > --- a/security/commoncap.c > +++ b/security/commoncap.c > @@ -649,6 +649,7 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, > > default: > /* No functionality available - continue with default */ > + *rc_p = 0; > return 0; > }
No, this case here means that the capability module is not taking responsibility for this call. So it should not be setting rc_p.
So you'll want to find another path in kernel/sys.c:sys_prctl() where error doesn't get set. Do you know what 'i' was in prctl01 at the time of failure?
For instance, I notice that PR_SET_DUMPABLE doesn't set the value of error if arg2 is valid. Also PR_SET_NAME and PR_GET_NAME don't set error.
-serge
| |