It seems we don't always handle bad user-mode pointers correctly.
If put_user is called with an unmapped AND unaligned address it
kills the current process instead of returning EFAULT.
The reason for this is that we do compute_return_epc() in do_ade()
before the exception table is searched, so we never get a match.
Below is a simple patch to fix it (attached as well).
The second part is not related, but it makes sense to only consult
the MF_FIXADE flag on exceptions originating from user-mode, right?
-Tommy
--- arch/mips/kernel/unaligned.c 2001/10/05 15:13:25 1.14
+++ arch/mips/kernel/unaligned.c 2001/10/29 12:39:56
@@ -353,12 +353,12 @@
fault:
/* Did we have an exception handler installed? */
- fixup = search_exception_table(regs->cp0_epc);
+ fixup = search_exception_table(pc);
if (fixup) {
long new_epc;
- new_epc = fixup_exception(dpf_reg, fixup, regs->cp0_epc);
+ new_epc = fixup_exception(dpf_reg, fixup, pc);
printk(KERN_DEBUG "%s: Forwarding exception at [<%lx>]
(%lx)\n",
- current->comm, regs->cp0_epc, new_epc);
+ current->comm, pc, new_epc);
regs->cp0_epc = new_epc;
return;
}
@@ -408,7 +408,7 @@
pc = regs->cp0_epc + ((regs->cp0_cause & CAUSEF_BD) ? 4 : 0);
if (compute_return_epc(regs))
return;
- if ((current->thread.mflags & MF_FIXADE) == 0)
+ if (user_mode(regs) && (current->thread.mflags & MF_FIXADE) == 0)
goto sigbus;
emulate_load_store_insn(regs, regs->cp0_badvaddr, pc);
(See attached file: unaligned.c.patch.gz)
unaligned.c.patch.gz
