Re: afterburned Linux: fixup exception problem

Thanks for the fixes.  I'm on vacation with horrible Internet access,  
and so it will be several weeks before I take action on any of this.

Perhaps the right fix is to include a special correction EIP in Linux  
for when using the afterburn hooks.

-Josh


On Apr 6, 2006, at 09:49, Frank Mehnert wrote:

Hi,

booting afterburned Linux 2.6.12.6 lead to a kernel panic

   "Unable to handle kernel NULL pointer dereference at virtual
    address 00000000"

The problem is that a user task does

   fd = open (0, x, y);

The kernel tries to copy the fname into kernel. On native Linux,
strncpy_from_user() raises a pagefault. In do_page_fault(),
fixup_exception() is called which sets the return code to -EFAULT
and then returns from the page fault handler. In afterburned Linux,
strncpy_from_user() calls afterburn_strncpy_from_user_hook() at first
which tries to resolve the page fault by sending the address to the
Linux kernel (do_page_fault()). Because there is no entry in the
exception table, do_page_fault() panics.

I'm unsure about the right fix for this problem. Most probably the
exception table must include an entry for each call of such an
afterburn_strncpy_*_hook() function. But the EIP must be delivered
to the wedge which must send the EIP to the Linux PF handler. Currently,
do_page_fault sees an EIP inside the wedge ...

Any ideas/fixes?

Frank
-- 
## InnoTek Systemberatung GmbH, http://www.innotek.de ##