Re: [PATCH] fix sys_prctl() returned uninitialized value

From: Andrew Morton
Date: Wed May 21 2008 - 23:33:15 EST


On Thu, 22 May 2008 11:19:21 +0800 Shi Weihua <shiwh@xxxxxxxxxxxxxx> wrote:

> When we test kernel by the latest LTP(20080430) on ia64,
> the following failure occured:
> -------------------------------------
> prctl01 1 PASS : Test Passed
> prctl01 0 WARN : prctl() returned 2048 errno = 0 : Success
> prctl01 1 PASS : Test Passed
> prctl01 2 FAIL : Test Failed
> -------------------------------------
>
> We found commit 3898b1b4ebff8dcfbcf1807e0661585e06c9a91c
> causes this failure by git-bisect.
> And, we found 'error' has not been initialized in the function
> sys_prctl()(kernel/sys.c). When the capability module is not taking
> responsibility for this call, sys_prctl() may return a wrong value.
>
> Now, i fixed it.
>
> Signed-off-by: Shi Weihua <shiwh@xxxxxxxxxxxxxx>
> ---
> diff --git a/kernel/sys.c b/kernel/sys.c
> index 895d2d4..26eb0f7 100644
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -1652,7 +1652,7 @@ asmlinkage long sys_umask(int mask)
> asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
> unsigned long arg4, unsigned long arg5)
> {
> - long uninitialized_var(error);
> + long error = 0;
>
> if (security_task_prctl(option, arg2, arg3, arg4, arg5, &error))
> return error;

Oh dear, there are so many things wrong with this...

- if security_task_prctl() is returning "fail" then why on earth
isn't it setting the error code?

- cap_task_prctl() _does_ set `error' is if returns non-zero, so it
must be one of the other myriad backend implementations of
security_task_prctl() which is busted. Which one is it?

- With the above patch applied, sys_prctl() will return zero (ie:
"success") even though it just failed.

- Can't we remove the sixth argument to security_task_prctl() and
just return the result code like a sane function would do?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/