From patchwork Tue Jul 8 17:18:42 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 33258 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-pa0-f72.google.com (mail-pa0-f72.google.com [209.85.220.72]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 8CAEA2070A for ; Wed, 9 Jul 2014 04:55:12 +0000 (UTC) Received: by mail-pa0-f72.google.com with SMTP id rd3sf47834597pab.3 for ; Tue, 08 Jul 2014 21:55:11 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:date :message-id:in-reply-to:references:cc:subject:precedence:list-id :list-unsubscribe:list-archive:list-post:list-help:list-subscribe :errors-to:sender:x-original-sender :x-original-authentication-results:mailing-list; bh=HLRNd72vri+9y5mbMu3jRZ50Be1PuhX2xTHLbvJ5CoY=; b=NpRG5EpRuFqKucjeTUyK0kkH0y8KDhOpe81+OOg5FU7347veqFXr5ZCICfdzAT8G+L SZ/18S8rU5tHOXnJ3WnjHA4XJJFzhxV+n2Gdae9tsUIbxdiRL4G8COx0Gst29gdeyyOU wgBUBbu3dPZdOIQh6Z7hdFCLVb7eAHhMhC5HSeartcl5Vt9xLDClWxBIbDMa50wtiD9l VSwpGxsfx9XXlnTqmZoHT/UwmX7mbHAAQywgWBv8c0Fr+A6jKP6hMv7uVQY6TtOTo29+ DNKWZcrehkeu0VBYIGhxZqNj2IwTUG0KlMn1crtuL1gpnIhYvNEqTJGOsjUZeEUt+KNn LVAw== X-Gm-Message-State: ALoCoQkAiPscONHEWYq3RVnPXtJ0DEmCIMPWPleNQSWHyK9+Z9aBMyS6l+0ICM+JzUX+ifjgn3OS X-Received: by 10.66.137.105 with SMTP id qh9mr19395762pab.30.1404881711562; Tue, 08 Jul 2014 21:55:11 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.140.94.107 with SMTP id f98ls2460096qge.65.gmail; Tue, 08 Jul 2014 21:55:11 -0700 (PDT) X-Received: by 10.58.234.103 with SMTP id ud7mr38097882vec.24.1404881711429; Tue, 08 Jul 2014 21:55:11 -0700 (PDT) Received: from mail-vc0-f169.google.com (mail-vc0-f169.google.com [209.85.220.169]) by mx.google.com with ESMTPS id fi5si20990181vdb.96.2014.07.08.21.55.11 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 08 Jul 2014 21:55:11 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.220.169 as permitted sender) client-ip=209.85.220.169; Received: by mail-vc0-f169.google.com with SMTP id la4so6568284vcb.0 for ; Tue, 08 Jul 2014 21:55:11 -0700 (PDT) X-Received: by 10.58.152.234 with SMTP id vb10mr37555657veb.21.1404881711094; Tue, 08 Jul 2014 21:55:11 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.221.37.5 with SMTP id tc5csp12952vcb; Tue, 8 Jul 2014 21:55:10 -0700 (PDT) X-Received: by 10.224.167.7 with SMTP id o7mr66130006qay.53.1404881710157; Tue, 08 Jul 2014 21:55:10 -0700 (PDT) Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id j10si32503491qao.21.2014.07.08.21.55.10 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Tue, 08 Jul 2014 21:55:10 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Received: from localhost ([::1]:57349 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X4ZWx-0008C2-JI for patch@linaro.org; Tue, 08 Jul 2014 13:50:15 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41953) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X4Z7J-0005Ep-HU for qemu-devel@nongnu.org; Tue, 08 Jul 2014 13:24:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X4Z6P-00013w-K7 for qemu-devel@nongnu.org; Tue, 08 Jul 2014 13:23:45 -0400 Received: from e36.co.us.ibm.com ([32.97.110.154]:32983) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X4Z6P-00013f-5p for qemu-devel@nongnu.org; Tue, 08 Jul 2014 13:22:49 -0400 Received: from /spool/local by e36.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 8 Jul 2014 11:22:48 -0600 Received: from d03dlp03.boulder.ibm.com (9.17.202.179) by e36.co.us.ibm.com (192.168.1.136) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 8 Jul 2014 11:22:46 -0600 Received: from b03cxnp08026.gho.boulder.ibm.com (b03cxnp08026.gho.boulder.ibm.com [9.17.130.18]) by d03dlp03.boulder.ibm.com (Postfix) with ESMTP id 4E21C19D8048; Tue, 8 Jul 2014 11:22:36 -0600 (MDT) Received: from d03av06.boulder.ibm.com (d03av06.boulder.ibm.com [9.17.195.245]) by b03cxnp08026.gho.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id s68HLaJY1769736; Tue, 8 Jul 2014 19:21:36 +0200 Received: from d03av06.boulder.ibm.com (loopback [127.0.0.1]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id s68HQnue012239; Tue, 8 Jul 2014 11:26:49 -0600 Received: from localhost ([9.41.105.211]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id s68HQm9s012227; Tue, 8 Jul 2014 11:26:48 -0600 From: Michael Roth To: qemu-devel@nongnu.org Date: Tue, 8 Jul 2014 12:18:42 -0500 Message-Id: <1404839947-1086-132-git-send-email-mdroth@linux.vnet.ibm.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1404839947-1086-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1404839947-1086-1-git-send-email-mdroth@linux.vnet.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 14070817-3532-0000-0000-000002FFC012 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 32.97.110.154 Cc: qemu-stable@nongnu.org Subject: [Qemu-devel] [PATCH 131/156] linux-user: Don't overrun guest buffer in sched_getaffinity X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: mdroth@linux.vnet.ibm.com X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.220.169 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 From: Peter Maydell If the guest's "long" type is smaller than the host's, then our sched_getaffinity wrapper needs to round the buffer size up to a multiple of the host sizeof(long). This means that when we copy the data back from the host buffer to the guest's buffer there might be more than we can fit. Rather than overflowing the guest's buffer, handle this case by returning EINVAL or ignoring the unused extra space, as appropriate. Note that only guests using the syscall interface directly might run into this bug -- the glibc wrappers around it will always use a buffer whose size is a multiple of 8 regardless of guest architecture. Signed-off-by: Peter Maydell Signed-off-by: Riku Voipio (cherry picked from commit be3bd286bc06bb68cdc71748d9dd4edcd57b2b24) Signed-off-by: Michael Roth --- linux-user/syscall.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 81f79f9..de8918d 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -7479,6 +7479,22 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask)); if (!is_error(ret)) { + if (ret > arg2) { + /* More data returned than the caller's buffer will fit. + * This only happens if sizeof(abi_long) < sizeof(long) + * and the caller passed us a buffer holding an odd number + * of abi_longs. If the host kernel is actually using the + * extra 4 bytes then fail EINVAL; otherwise we can just + * ignore them and only copy the interesting part. + */ + int numcpus = sysconf(_SC_NPROCESSORS_CONF); + if (numcpus > arg2 * 8) { + ret = -TARGET_EINVAL; + break; + } + ret = arg2; + } + if (copy_to_user(arg3, mask, ret)) { goto efault; }