tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

x86: don't allow tail-calls in sys_ftruncate[64]()

Gcc thinks it owns the incoming argument stack, but that's not true for
"asmlinkage" functions, and it corrupts the caller-set-up argument stack
when it pushes the third argument onto the stack. Which can result in
%ebx getting corrupted in user space.

Now, normally nobody sane would ever notice, since libc will save and
restore %ebx anyway over the system call, but it's still wrong.

I'd much rather have "asmlinkage" tell gcc directly that it doesn't own
the stack, but no such attribute exists, so we're stuck with our hacky
manual "prevent_tail_call()" macro once more (we've had the same issue
before with sys_waitpid() and sys_wait4()).

Thanks to Hans-Werner Hilse <hilse@sub.uni-goettingen.de> for reporting
the issue and testing the fix.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Linus Torvalds 0a489cb3 ac69e973

+6 -2
+6 -2
fs/open.c
··· 331 331 332 332 asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length) 333 333 { 334 - return do_sys_ftruncate(fd, length, 1); 334 + long ret = do_sys_ftruncate(fd, length, 1); 335 + prevent_tail_call(ret); 336 + return ret; 335 337 } 336 338 337 339 /* LFS versions of truncate are only needed on 32 bit machines */ ··· 345 343 346 344 asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length) 347 345 { 348 - return do_sys_ftruncate(fd, length, 0); 346 + long ret = do_sys_ftruncate(fd, length, 0); 347 + prevent_tail_call(ret); 348 + return ret; 349 349 } 350 350 #endif 351 351