aboutsummaryrefslogtreecommitdiffstats
path: root/arch/um/kernel
diff options
context:
space:
mode:
authorJeff Dike <jdike@addtoit.com>2007-09-19 01:46:49 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-09-19 14:24:18 -0400
commit508a92741a105e2e3d466cd727fb73154ebf08de (patch)
tree4dabe8327cc47c2d26239d227d48fc83944e5ff1 /arch/um/kernel
parent480eccf9ae1073b87bb4fe118971fbf134a5bc61 (diff)
uml: fix irqstack crash
This patch fixes a crash caused by an interrupt coming in when an IRQ stack is being torn down. When this happens, handle_signal will loop, setting up the IRQ stack again because the tearing down had finished, and handling whatever signals had come in. However, to_irq_stack returns a mask of pending signals to be handled, plus bit zero is set if the IRQ stack was already active, and thus shouldn't be torn down. This causes a problem because when handle_signal goes around the loop, sig will be zero, and to_irq_stack will duly set bit zero in the returned mask, faking handle_signal into believing that it shouldn't tear down the IRQ stack and return thread_info pointers back to their original values. This will eventually cause a crash, as the IRQ stack thread_info will continue pointing to the original task_struct and an interrupt will look into it after it has been freed. The fix is to stop passing a signal number into to_irq_stack. Rather, the pending signals mask is initialized beforehand with the bit for sig already set. References to sig in to_irq_stack can be replaced with references to the mask. [akpm@linux-foundation.org: use UL] Signed-off-by: Jeff Dike <jdike@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'arch/um/kernel')
-rw-r--r--arch/um/kernel/irq.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
index 9870febdbead..cf0dd9cf8c43 100644
--- a/arch/um/kernel/irq.c
+++ b/arch/um/kernel/irq.c
@@ -518,13 +518,13 @@ int init_aio_irq(int irq, char *name, irq_handler_t handler)
518 518
519static unsigned long pending_mask; 519static unsigned long pending_mask;
520 520
521unsigned long to_irq_stack(int sig, unsigned long *mask_out) 521unsigned long to_irq_stack(unsigned long *mask_out)
522{ 522{
523 struct thread_info *ti; 523 struct thread_info *ti;
524 unsigned long mask, old; 524 unsigned long mask, old;
525 int nested; 525 int nested;
526 526
527 mask = xchg(&pending_mask, 1 << sig); 527 mask = xchg(&pending_mask, *mask_out);
528 if(mask != 0){ 528 if(mask != 0){
529 /* If any interrupts come in at this point, we want to 529 /* If any interrupts come in at this point, we want to
530 * make sure that their bits aren't lost by our 530 * make sure that their bits aren't lost by our
@@ -534,7 +534,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out)
534 * and pending_mask contains a bit for each interrupt 534 * and pending_mask contains a bit for each interrupt
535 * that came in. 535 * that came in.
536 */ 536 */
537 old = 1 << sig; 537 old = *mask_out;
538 do { 538 do {
539 old |= mask; 539 old |= mask;
540 mask = xchg(&pending_mask, old); 540 mask = xchg(&pending_mask, old);
@@ -550,6 +550,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out)
550 550
551 task = cpu_tasks[ti->cpu].task; 551 task = cpu_tasks[ti->cpu].task;
552 tti = task_thread_info(task); 552 tti = task_thread_info(task);
553
553 *ti = *tti; 554 *ti = *tti;
554 ti->real_thread = tti; 555 ti->real_thread = tti;
555 task->stack = ti; 556 task->stack = ti;