Re: [PATCH] i386 - sys_clone from vsyscall

[Chuck Ebbert <76306.1226@compuserve.com>]

In-Reply-To: <401b11ae0601110953h2389f118t3d4d11c33eece4f8@mail.gmail.com>

On Wed, 11 Jan 2006 at 17:53:10 +0000, erg0t wrote:

> This patch fixes a little problem when sys_clone is called from
> a vsyscall and a new stack for the child is specifed.
> Some regs, and return address are pushed in the stack before sysenter,
> so when the syscall returns, pop the regs and return, if we made
> a new stack for the thread we need to copy that to the new stack
> or the thread will segfault.

glibc works around this bug by hardcoding "int 0x80" at
glibc-2.3.5/sysdeps/unix/sysv/linux/i386/clone.S line 99.

> Sorry for use the 0xffffe410 constant I didn't find another way
> to reference it.

It's SYSENTER_RETURN.

> Signed-off-by: Daniel F <ergot86@gmail.com>

Your patch almost works but it copies the stack into the parent's address space.
Using access_process_vm() fixes it.  However, that still leaves unfixed the case
where vsyscall-int80 is used.


[patch] i386: fix sys_clone when using vsyscall-sysenter

Fix a problem when sys_clone is called from sysenter vsyscall and a new stack
for the child is specified.  Some data needs to be copied from the parent
to the child stack or the child will segfault.

Bug report and initial patch from Daniel F <ergot86@gmail.com>

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>

--- 2.6.15a.orig/arch/i386/kernel/process.c
+++ 2.6.15a/arch/i386/kernel/process.c
@@ -429,12 +429,15 @@ void prepare_to_copy(struct task_struct 
 	unlazy_fpu(tsk);
 }
 
+void SYSENTER_RETURN(void);
+
 int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
 	unsigned long unused,
 	struct task_struct * p, struct pt_regs * regs)
 {
 	struct pt_regs * childregs;
 	struct task_struct *tsk;
+	unsigned long vsyscall_stack[4];
 	int err;
 
 	childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
@@ -451,6 +454,19 @@ int copy_thread(int nr, unsigned long cl
 	childregs = (struct pt_regs *) ((unsigned long) childregs - 8);
 	*childregs = *regs;
 	childregs->eax = 0;
+	/*
+	 * When we were called from a vsyscall some things are pushed on the stack;
+	 * we need to copy the stuff to the new stack.
+	 */
+	if (regs->esp != esp && (void *)regs->eip == SYSENTER_RETURN) {
+		int size = sizeof(vsyscall_stack);
+
+		if (copy_from_user(vsyscall_stack, (void *)regs->esp, size))
+			return -EFAULT;
+		if (access_process_vm(p, esp - size, vsyscall_stack, size, 1) != size)
+			return -EFAULT;
+		esp -= size;
+	}
 	childregs->esp = esp;
 
 	p->thread.esp = (unsigned long) childregs;
-- 
Chuck