Patches for bugs in ARM code...
Scott Bambrough
scottb@corelcomputer.com
Wed Apr 14 13:27:00 GMT 1999
I found a nasty bug in sysdeps/unix/sysv/linux/arm/socket.S. We had a bug with
ping. It was always printing the error `Socket operation on non-socket.`. An
strace showed the recvfrom call was failing on restart after the signal was
handled. Its parameters were garbage. This is because the socket call never
modifies sp; it moves sp into ip and uses ip to push the args, so it never has
to clean up the stack.
This is nice as it saves one instruction, however the syscall is not an atomic
operation. It can be interrupted if a signal occurs. If the signal handler
uses any stack it trashes the socket call args, because according to it the next
available stack slot is pointed at by sp.
Now for the really bad news. mmap() suffers from the same bug. Yuck!
1999-04-14 Scott Bambrough <scottb@netwinder.org>
* sysdeps/unix/sysv/linux/arm/socket.S:
Socket calls could not be restarted after being interrupted by
a signal. The parameters on the stack were corrupted by the
signal handler.
* sysdeps/unix/sysv/linux/arm/mmap.S:
mmap calls could not be restarted after being interrupted by
a signal. The parameters on the stack were corrupted by the
signal handler.
Index: mmap.S
===================================================================
RCS file: /glibc/cvsfiles/libc/sysdeps/unix/sysv/linux/arm/mmap.S,v
retrieving revision 1.2
diff -r1.2 mmap.S
29,31c29,43
< mov ip, sp
< stmdb ip!, {a1-a4}
< mov a1, ip
---
> /* This code previously moved sp into ip and stored the args using
> stmdb ip!, {a1-a4}. It did not modify sp, so the stack never had
> to be restored after the syscall completed. It saved an
> instruction and meant no stack cleanup work was required.
>
> This will not work in the case of a mmap call being interrupted
> by a signal. If the signal handler uses any stack the arguments
> to mmap will be trashed. The results of a restart of mmap are
> then unpredictable. */
>
> /* store args on the stack */
> stmdb sp!, {a1-a4}
>
> /* do the syscall */
> mov a1, sp
32a45,48
>
> /* pop args off the stack. */
> add sp, sp, #16
>
More information about the Libc-hacker
mailing list