2012-02-11 05:54:54

by Josh Hunt

[permalink] [raw]
Subject: [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels

We have hit an issue where our 32-bit applications using poll() and
passing in a value of -1 for the timeout value return after ~49 days
(2^32 msec), instead of waiting indefinitely. I've instrumented the
kernel and found we are hitting the case where poll() believes we've
passed in a positive number and thus creates a timespec, etc. I've
implemented compat_sys_poll() to sign-extend the timeout value and
resolve the issue.

There was an almost identical patch submitted last year, but for
whatever reason did not make it in:
https://lkml.org/lkml/2011/9/18/19

I am guessing there are other architectures affected by this bug. This
patch only fixes x86.

Josh


Attachments:
compat-sys-poll.patch (2.28 kB)

2012-02-11 15:47:33

by Eric Dumazet

[permalink] [raw]
Subject: Re: [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels

Le vendredi 10 février 2012 à 23:54 -0600, Josh Hunt a écrit :
> We have hit an issue where our 32-bit applications using poll() and
> passing in a value of -1 for the timeout value return after ~49 days
> (2^32 msec), instead of waiting indefinitely. I've instrumented the
> kernel and found we are hitting the case where poll() believes we've
> passed in a positive number and thus creates a timespec, etc. I've
> implemented compat_sys_poll() to sign-extend the timeout value and
> resolve the issue.
>
> There was an almost identical patch submitted last year, but for
> whatever reason did not make it in:
> https://lkml.org/lkml/2011/9/18/19

Probably because Thomas Meyer didnt answer to patch reviewers, and not
enough people cared.

By the way, an inline patch is better, as stated in
Documentation/SubmittingPatches

Anyway, its time to fix this bug...

Acked-by: Eric Dumazet <[email protected]>


2012-02-16 16:22:13

by Josh Hunt

[permalink] [raw]
Subject: Re: [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels

On 02/11/2012 09:47 AM, Eric Dumazet wrote:
> Le vendredi 10 février 2012 à 23:54 -0600, Josh Hunt a écrit :
>> We have hit an issue where our 32-bit applications using poll() and
>> passing in a value of -1 for the timeout value return after ~49 days
>> (2^32 msec), instead of waiting indefinitely. I've instrumented the
>> kernel and found we are hitting the case where poll() believes we've
>> passed in a positive number and thus creates a timespec, etc. I've
>> implemented compat_sys_poll() to sign-extend the timeout value and
>> resolve the issue.
>>
>> There was an almost identical patch submitted last year, but for
>> whatever reason did not make it in:
>> https://lkml.org/lkml/2011/9/18/19
>
> Probably because Thomas Meyer didnt answer to patch reviewers, and not
> enough people cared.
>
> By the way, an inline patch is better, as stated in
> Documentation/SubmittingPatches
>
> Anyway, its time to fix this bug...
>
> Acked-by: Eric Dumazet <[email protected]>
>

I can resubmit the patch inline if you feel that will get more attention
by whoever needs to do the final approval on this.

Josh