Date: Mon, 01 May 2017 09:36:43 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 218987] [patch][linux] panic in linux_sys_futex() with FUTEX_WAKE_OP Message-ID: <bug-218987-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D218987 Bug ID: 218987 Summary: [patch][linux] panic in linux_sys_futex() with FUTEX_WAKE_OP Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Keywords: patch Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: luke.tw@gmail.com Keywords: patch Created attachment 182207 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D182207&action= =3Dedit patch for linux_sys_futex() In linux compat layer, the syscall futex does not handle FUTEX_WAKE_OP well when using the same address for arguments uaddr and uaddr2.=20 The following linux program can result in kernel panic. #define _GNU_SOURCE #include <stdio.h> #include <errno.h> #include <stdlib.h> #include <unistd.h> #include <sys/wait.h> #include <sys/mman.h> #include <sys/syscall.h> #include <linux/futex.h> #include <sys/time.h> static int futex(int *uaddr, int futex_op, int val, int val2, int *uaddr2, int val3) { return syscall(SYS_futex, uaddr, futex_op, val, val2, uaddr, val3); } int main(void){ int ret; int addr; ret =3D futex(&addr, FUTEX_WAKE_OP, 1, 1, &addr, 2); printf("ret: %d\n", ret); } --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-218987-8>