aboutsummaryrefslogtreecommitdiffstats
path: root/arch/um/os-Linux
diff options
context:
space:
mode:
authorJeff Dike <jdike@addtoit.com>2007-09-19 01:46:49 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-09-19 14:24:18 -0400
commit508a92741a105e2e3d466cd727fb73154ebf08de (patch)
tree4dabe8327cc47c2d26239d227d48fc83944e5ff1 /arch/um/os-Linux
parent480eccf9ae1073b87bb4fe118971fbf134a5bc61 (diff)
uml: fix irqstack crash
This patch fixes a crash caused by an interrupt coming in when an IRQ stack is being torn down. When this happens, handle_signal will loop, setting up the IRQ stack again because the tearing down had finished, and handling whatever signals had come in. However, to_irq_stack returns a mask of pending signals to be handled, plus bit zero is set if the IRQ stack was already active, and thus shouldn't be torn down. This causes a problem because when handle_signal goes around the loop, sig will be zero, and to_irq_stack will duly set bit zero in the returned mask, faking handle_signal into believing that it shouldn't tear down the IRQ stack and return thread_info pointers back to their original values. This will eventually cause a crash, as the IRQ stack thread_info will continue pointing to the original task_struct and an interrupt will look into it after it has been freed. The fix is to stop passing a signal number into to_irq_stack. Rather, the pending signals mask is initialized beforehand with the bit for sig already set. References to sig in to_irq_stack can be replaced with references to the mask. [akpm@linux-foundation.org: use UL] Signed-off-by: Jeff Dike <jdike@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'arch/um/os-Linux')
-rw-r--r--arch/um/os-Linux/signal.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index 18e5c8b67eb8..b98f7ea2d2f6 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -119,7 +119,7 @@ void (*handlers[_NSIG])(int sig, struct sigcontext *sc);
119 119
120void handle_signal(int sig, struct sigcontext *sc) 120void handle_signal(int sig, struct sigcontext *sc)
121{ 121{
122 unsigned long pending = 0; 122 unsigned long pending = 1UL << sig;
123 123
124 do { 124 do {
125 int nested, bail; 125 int nested, bail;
@@ -134,7 +134,7 @@ void handle_signal(int sig, struct sigcontext *sc)
134 * have to return, and the upper handler will deal 134 * have to return, and the upper handler will deal
135 * with this interrupt. 135 * with this interrupt.
136 */ 136 */
137 bail = to_irq_stack(sig, &pending); 137 bail = to_irq_stack(&pending);
138 if(bail) 138 if(bail)
139 return; 139 return;
140 140