• P
    linux-user: Don't use sigfillset() on uc->uc_sigmask · 1d48fdd9
    Peter Maydell 提交于
    The kernel and libc have different ideas about what a sigset_t
    is -- for the kernel it is only _NSIG / 8 bytes in size (usually
    8 bytes), but for libc it is much larger, 128 bytes. In most
    situations the difference doesn't matter, because if you pass a
    pointer to a libc sigset_t to the kernel it just acts on the first
    8 bytes of it, but for the ucontext_t* argument to a signal handler
    it trips us up. The kernel allocates this ucontext_t on the stack
    according to its idea of the sigset_t type, but the type of the
    ucontext_t defined by the libc headers uses the libc type, and
    so do the manipulator functions like sigfillset(). This means that
     (1) sizeof(uc->uc_sigmask) is much larger than the actual
         space used on the stack
     (2) sigfillset(&uc->uc_sigmask) will write garbage 0xff bytes
         off the end of the structure, which can trash data that
         was on the stack before the signal handler was invoked,
         and may result in a crash after the handler returns
    
    To avoid this, we use a memset() of the correct size to fill
    the signal mask rather than using the libc function.
    
    This fixes a problem where we would crash at least some of the
    time on an i386 host when a signal was taken.
    Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
    Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
    Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>
    1d48fdd9
syscall.c 347.9 KB