lkml.org 
[lkml]   [2009]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: 2.6.29-rc3-git6: Reported regressions from 2.6.28

* Linus Torvalds <torvalds@linux-foundation.org> wrote:

> > Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=12505
> > Subject : 2.6.29-rc1 Firefox crashing on page load
> > Submitter : Justin Madru <jdm64@gawab.com>
> > Date : 2009-01-16 20:56 (20 days old)
> > First-Bad-Commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4217458dafaa57d8e26a46f5d05ab8c53cf64191
> > References : http://marc.info/?l=linux-kernel&m=123213941914274&w=4
> > Handled-By : Justin P. Mattock <justinmattock@gmail.com>
>
> Heh. That commit you point to is very innocuous.
>
> Commit 4217458dafaa57d8e26a46f5d05ab8c53cf64191 is a pure cleanup, and it
> _does_ make the code look nicer, but while it looks lik a total no-op, it
> actually has a very subtle behavioural change: it makes gcc think that it
> owns the whole argument stack. Which is _not_ true of 'asmlinkage'
> functions, but we've never been able to tell gcc to keep its grubby hands
> off our stack.
>
> So I suspect that gcc inlines the function and then creates a function
> call that re-uses the "struct pt_regs" on the stack as the argument area
> too. Which corrupts the "pt_regs", and then we return to user space with
> some random register contents.

yes - i tracked it down back then, just the regression entry didnt get
updated.

> So I think we need to just revert it. Ingo, Hiroshi?

should be fixed upstream by:

552b8aa: Revert "x86: signal: change type of paramter for sys_rt_sigreturn()"

the revert commit is below with explaination - also with a Tested-by tag.
The revert is not a pure revert - it also adds a comment to preserve this
circumstance cleanly.

We first had a few fruitless attempts to annotate it in some clear fashion
(the existing tailcall-avoidance macros we have didnt suit this case) - then
went for the revert because none of the variants that told gcc not to screw
up actually made the code better than it was originally.

Ingo

-------------->
From 552b8aa4d1edcc1c764ff6f61a7686347a2d1827 Mon Sep 17 00:00:00 2001
From: Ingo Molnar <mingo@elte.hu>
Date: Tue, 20 Jan 2009 09:31:49 +0100
Subject: [PATCH] Revert "x86: signal: change type of paramter for sys_rt_sigreturn()"

This reverts commit 4217458dafaa57d8e26a46f5d05ab8c53cf64191.

Justin Madru bisected this commit, it was causing weird Firefox
crashes.

The reason is that GCC mis-optimizes (re-uses) the on-stack parameters of
the calling frame, which corrupts the syscall return pt_regs state and
thus corrupts user-space register state.

So we go back to the slightly less clean but more optimization-safe
method of getting to pt_regs. Also add a comment to explain this.

Resolves: http://bugzilla.kernel.org/show_bug.cgi?id=12505

Reported-and-bisected-by: Justin Madru <jdm64@gawab.com>
Tested-by: Justin Madru <jdm64@gawab.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
arch/x86/include/asm/syscalls.h | 2 +-
arch/x86/kernel/signal.c | 11 +++++++++--
2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/syscalls.h b/arch/x86/include/asm/syscalls.h
index 9c6797c..c0b0bda 100644
--- a/arch/x86/include/asm/syscalls.h
+++ b/arch/x86/include/asm/syscalls.h
@@ -40,7 +40,7 @@ asmlinkage int sys_sigaction(int, const struct old_sigaction __user *,
struct old_sigaction __user *);
asmlinkage int sys_sigaltstack(unsigned long);
asmlinkage unsigned long sys_sigreturn(unsigned long);
-asmlinkage int sys_rt_sigreturn(struct pt_regs);
+asmlinkage int sys_rt_sigreturn(unsigned long);

/* kernel/ioport.c */
asmlinkage long sys_iopl(unsigned long);
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 89bb766..df0587f 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -632,9 +632,16 @@ badframe:
}

#ifdef CONFIG_X86_32
-asmlinkage int sys_rt_sigreturn(struct pt_regs regs)
+/*
+ * Note: do not pass in pt_regs directly as with tail-call optimization
+ * GCC will incorrectly stomp on the caller's frame and corrupt user-space
+ * register state:
+ */
+asmlinkage int sys_rt_sigreturn(unsigned long __unused)
{
- return do_rt_sigreturn(&regs);
+ struct pt_regs *regs = (struct pt_regs *)&__unused;
+
+ return do_rt_sigreturn(regs);
}
#else /* !CONFIG_X86_32 */
asmlinkage long sys_rt_sigreturn(struct pt_regs *regs)

\
 
 \ /
  Last update: 2009-02-04 17:35    [W:0.535 / U:0.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site