mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 06:10:56 +00:00
alpha: fix crash if pthread_create races with signal delivery
commit 21ffceda1c
upstream.
On alpha, a process will crash if it attempts to start a thread and a
signal is delivered at the same time. The crash can be reproduced with
this program: https://cygwin.com/ml/cygwin/2014-11/msg00473.html
The reason for the crash is this:
* we call the clone syscall
* we go to the function copy_process
* copy process calls copy_thread_tls, it is a wrapper around copy_thread
* copy_thread sets the tls pointer: childti->pcb.unique = regs->r20
* copy_thread sets regs->r20 to zero
* we go back to copy_process
* copy process checks "if (signal_pending(current))" and returns
-ERESTARTNOINTR
* the clone syscall is restarted, but this time, regs->r20 is zero, so
the new thread is created with zero tls pointer
* the new thread crashes in start_thread when attempting to access tls
The comment in the code says that setting the register r20 is some
compatibility with OSF/1. But OSF/1 doesn't use the CLONE_SETTLS flag, so
we don't have to zero r20 if CLONE_SETTLS is set. This patch fixes the bug
by zeroing regs->r20 only if CLONE_SETTLS is not set.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
21f94109d0
commit
68d18e90ee
1 changed files with 2 additions and 1 deletions
|
@ -265,12 +265,13 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
|
||||||
application calling fork. */
|
application calling fork. */
|
||||||
if (clone_flags & CLONE_SETTLS)
|
if (clone_flags & CLONE_SETTLS)
|
||||||
childti->pcb.unique = regs->r20;
|
childti->pcb.unique = regs->r20;
|
||||||
|
else
|
||||||
|
regs->r20 = 0; /* OSF/1 has some strange fork() semantics. */
|
||||||
childti->pcb.usp = usp ?: rdusp();
|
childti->pcb.usp = usp ?: rdusp();
|
||||||
*childregs = *regs;
|
*childregs = *regs;
|
||||||
childregs->r0 = 0;
|
childregs->r0 = 0;
|
||||||
childregs->r19 = 0;
|
childregs->r19 = 0;
|
||||||
childregs->r20 = 1; /* OSF/1 has some strange fork() semantics. */
|
childregs->r20 = 1; /* OSF/1 has some strange fork() semantics. */
|
||||||
regs->r20 = 0;
|
|
||||||
stack = ((struct switch_stack *) regs) - 1;
|
stack = ((struct switch_stack *) regs) - 1;
|
||||||
*childstack = *stack;
|
*childstack = *stack;
|
||||||
childstack->r26 = (unsigned long) ret_from_fork;
|
childstack->r26 = (unsigned long) ret_from_fork;
|
||||||
|
|
Loading…
Reference in a new issue