Subject: Bug in get_insn_opcode.

From: Carsten Langgaard <[email-masked]>
Date: Fri, 02 Mar 2001 17:56:48 +0100

There is a bug in the function get_insn_opcode in traps.c

As 'epc' is an int pointer here, it should only be increased by 1 (4
byte) and not by 4 (4*4 = 16 bytes).
See the patch below.

/Carsten

Index: arch/mips/kernel/traps.c
===================================================================
RCS file: /home/repository/sw/linux-2.4.0/arch/mips/kernel/traps.c,v
retrieving revision 1.10
diff -u -r1.10 traps.c
--- traps.c     2001/02/28 13:46:43     1.10
+++ traps.c     2001/03/02 16:50:27
@@ -410,7 +410,7 @@

        epc = (unsigned int *) (unsigned long) regs->cp0_epc;
        if (regs->cp0_cause & CAUSEF_BD)
-               epc += 4;
+               epc++;

        if (verify_area(VERIFY_READ, epc, 4)) {
                force_sig(SIGSEGV, current);
Index: arch/mips64/kernel/traps.c
===================================================================
RCS file: /home/repository/sw/linux-2.4.0/arch/mips64/kernel/traps.c,v
retrieving revision 1.5
diff -u -r1.5 traps.c
--- traps.c     2001/02/19 16:02:52     1.5
+++ traps.c     2001/03/02 16:50:13
@@ -371,7 +371,7 @@

        epc = (unsigned int *) (unsigned long) regs->cp0_epc;
        if (regs->cp0_cause & CAUSEF_BD)
-               epc += 4;
+               epc++;

        if (verify_area(VERIFY_READ, epc, 4)) {
                force_sig(SIGSEGV, current);

--
_    _ ____  ___   Carsten Langgaard   Mailto:[email-masked]
|\  /|||___)(___   MIPS Denmark        Direct: +45 4486 5527
| \/ |||    ____)  Lautrupvang 4B      Switch: +45 4486 5555
  TECHNOLOGIES     2750 Ballerup       Fax...: +45 4486 5556
                   Denmark             http://www.mips.com

---

From: Jun Sun <[email-masked]>
Date: Fri, 2 Mar 2001 10:34:49 -0800

> byte) and not by 4 (4*4 = 16 bytes).

Good catch!

I am surprised that trap on branch delay slot is rare that we only discover
this bug now ...

Jun

---

From: Ralf Baechle <[email-masked]>
Date: Sat, 3 Mar 2001 08:21:15 +0100

On Fri, Mar 02, 2001 at 05:56:48PM +0100, Carsten Langgaard wrote:
> Date:   Fri, 02 Mar 2001 17:56:48 +0100
> From: Carsten Langgaard <[email-masked]>
> To: [email-masked]
> Subject: Bug in get_insn_opcode.
> 

> Index: arch/mips/kernel/traps.c

Patch will behave (un-)funny on a cvs diff generated patch like this which
lacks full pathnames in the --- and +++ lines.  Patches for this
behaviour are available on ftp.cyclic.com (so it still exists ...) or in
more recent cvs rpms.

Applied anyway, of course.

  Ralf

---

From: Geert Uytterhoeven <[email-masked]>
Date: Sat, 3 Mar 2001 16:15:05 +0100 (CET)

> behaviour are available on ftp.cyclic.com (so it still exists ...) or in

Isn't patch supposed to look at the `Index' line?

Gr{oetje,eeting}s,

						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email-masked]

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
							    -- Linus Torvalds

---

From: Ralf Baechle <[email-masked]>
Date: Sun, 4 Mar 2001 20:48:26 +0100

> Isn't patch supposed to look at the `Index' line?

Only when the environment variable POSIXLY_CORRECT is set to y which has
a ton of other unwanted side effects, so patch would need wrapper scripts
or what not else.

  Ralf