|
Bugzilla – Full Text Bug Listing |
| Summary: | LTP ioctl01.c: ioctl(TCGETS) does not check validity of pointer argument on PPC64LE | ||
|---|---|---|---|
| Product: | [openSUSE] PUBLIC SUSE Linux Enterprise Server 15 SP6 | Reporter: | WEI GAO <wegao> |
| Component: | Kernel | Assignee: | Jiri Slaby <jslaby> |
| Status: | RESOLVED WONTFIX | QA Contact: | |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | eugenio.paolantonio, jslaby, martin.doucha, meissner, mhocko, msuchanek, petr.vorel, rfrohl, wegao |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | PowerPC-64 | ||
| OS: | Other | ||
| URL: | https://openqa.suse.de/tests/12799195/modules/ioctl01/steps/7 | ||
| See Also: | https://bugzilla.suse.com/show_bug.cgi?id=1217145 | ||
| Whiteboard: | |||
| Found By: | openQA | Services Priority: | |
| Business Priority: | Blocker: | Yes | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
WEI GAO
2023-11-14 13:37:04 UTC
The above bugreport is incorrect. The ioctl01 test was recently rewritten to include termios subtests which trigger the following failure: openpty(&master, &slave, NULL, NULL, NULL); ret = ioctl(master, TCGETS, (struct termios *)-1); The test expects that the ioctl() call will fail with EFAULT like TCGETA does with the exact same invalid pointer value. But it sends SIGSEGV to the test process instead. The INVAL_IOCTL subtest mentioned above does not get to run due to the above segfault. All supported SLE versions are affected on PPC64LE (SLE-12SP5+), including SLE-15SP6. Other archs are not affected. perhaps for Jiri Slaby? TCGETS is of course checked. So: can I see the crash (full dmesg output)? (In reply to Jiri Slaby from comment #5) > TCGETS is of course checked. So: can I see the crash (full dmesg output)? It's check on all archs except PPC64LE. There must be some platform-specific mess-up. There isn't much dmesg output. It's a userspace segfault, not a kernel crash: https://openqa.suse.de/tests/12988674/logfile?filename=serial0.txt OpenQA::run_ltp.pm: Starting ioctl01 [ 957.493390][T21251] ioctl01[21251]: segfault (11) at 37 nip 7fff9505a80c lr 7fff9505b750 code 1 in libc-2.31.so[7fff94f30000+200000] [ 957.493556][T21251] ioctl01[21251]: code: 7c0802a6 81210054 81610030 80c10034 80e10038 387f0011 8901004f 81410050 [ 957.493642][T21251] ioctl01[21251]: code: 38a00013 3881003c f8010080 8001002c <913f0038> 917f0004 90df0008 90ff000c OpenQA::run_ltp.pm: Starting ioctl02 glibc translates it to
__ioctl (int fd, unsigned long int request, ...)
{
void *arg;
va_list ap;
int result;
va_start (ap, request);
arg = va_arg (ap, void *);
switch (request)
{
case TCGETS:
result = __tcgetattr (fd, (struct termios *) arg);
break;
whih is
/* Put the state of FD into *TERMIOS_P. */
int
__tcgetattr (int fd, struct termios *termios_p)
{
struct __kernel_termios k_termios;
int retval;
retval = INLINE_SYSCALL (ioctl, 3, fd, TCGETS, &k_termios);
if (__glibc_likely (retval == 0))
{
termios_p->c_iflag = k_termios.c_iflag;
termios_p->c_oflag = k_termios.c_oflag;
termios_p->c_cflag = k_termios.c_cflag;
termios_p->c_lflag = k_termios.c_lflag;
termios_p->c_line = k_termios.c_line;
#ifdef _HAVE_STRUCT_TERMIOS_C_ISPEED
# ifdef _HAVE_C_ISPEED
So basically glibc maps the ioctl TCGETS systemcall in its own code, uses a different struct for the kernel and then the later copy crashes.
I think this is not a real valid test when passing in invalid pointers anything could happen, garbage in/garbage out style.
it seems only powerpc does this ioctl translation of termios related stuff, so t hats why its only visibile on ppc. Ah, sure, ppc is currently the only arch not implementing TCGETS2. This is WONTFIX for SLE, but let me fix that in upstream. (In reply to Jiri Slaby from comment #9) > Ah, sure, ppc is currently the only arch not implementing TCGETS2. That's not the problem. ppc defines struct ktermios a weird way. So translation has to be done. (There is nothing we can do here.) (In reply to Jiri Slaby from comment #9) > Ah, sure, ppc is currently the only arch not implementing TCGETS2. > > This is WONTFIX for SLE, but let me fix that in upstream. @Jiri, any progress with upstream? Please post link to the patch here or Cc me, when you get time for it. Petr Vorel from comment #11) > @Jiri, any progress with upstream? Please post link to the patch here or Cc > me, when you get time for it. The issue is WONTFIX. The only thing we can do is change or disable the test because data conversion in Glibc is unavoidable due to PPC kernel API weirdness. The recommended way to check memory access from userspace is to submit that memory region to a write() to pipe. That could convert the sigsegv into EFAULT at the cost of opening a pipe. (In reply to Marcus Meissner from comment #8) > it seems only powerpc does this ioctl translation of termios related stuff, > so t hats why its only visibile on ppc. I see: sysdeps/unix/sysv/linux/powerpc/internal-ioctl.h (TCGETS) (In reply to Michal Suchanek from comment #13) > The recommended way to check memory access from userspace is to submit that > memory region to a write() to pipe. That could convert the sigsegv into > EFAULT at the cost of opening a pipe. Thanks for a hint. |