From patchwork Wed Aug 6 20:39:14 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 34996 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-pa0-f71.google.com (mail-pa0-f71.google.com [209.85.220.71]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 0953420523 for ; Wed, 6 Aug 2014 21:04:50 +0000 (UTC) Received: by mail-pa0-f71.google.com with SMTP id et14sf19835270pad.2 for ; Wed, 06 Aug 2014 14:04:50 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:date :message-id:in-reply-to:references:cc:subject:precedence:list-id :list-unsubscribe:list-archive:list-post:list-help:list-subscribe :errors-to:sender:x-original-sender :x-original-authentication-results:mailing-list; bh=AWlroM03WtD/dufY1Es0lKhJhYkFDHAc4VfOqyfSgZA=; b=Xv0xjwkEx9bINBcwmWuPYF1U7Z8+xNQWFr39h2kpaAWza7z2PZ3bZ4RPSwhxwxrPpv ocqoDNZkwF3WRe7YUQSI9BIXHcunyqo016dvI1EoY3K+rZWSBsnP0u/yqnkWpifQYDFp LByMeEqG38D5LWKIfKcY6BrLZzmrU/5t64ltO9a9W2rIM+hEKLZFWYeNxo7QAmJ9gzG+ W6agRn48UjSHBmUtsZcmq1xAU+Sw9WTPRPYAL7Xc3WMOG6xXGYD+586JQDvYxp8i3hhZ AR5EuMoowXOqm3wp71pVGgQOSVaXi3bmtGpqeL+9f0eAvkZy/jQ2K3Vl5TlUxwYjDsnd wuYw== X-Gm-Message-State: ALoCoQkbTJOuVcXgVSylKOtuHFhWrqncbP0QvEtdg83arLnOo8Z+zb+aanW6rsjuaIvRsycdIma4 X-Received: by 10.66.151.140 with SMTP id uq12mr6947801pab.23.1407359090290; Wed, 06 Aug 2014 14:04:50 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.140.92.140 with SMTP id b12ls382280qge.88.gmail; Wed, 06 Aug 2014 14:04:50 -0700 (PDT) X-Received: by 10.52.239.6 with SMTP id vo6mr3451398vdc.59.1407359090170; Wed, 06 Aug 2014 14:04:50 -0700 (PDT) Received: from mail-vc0-f172.google.com (mail-vc0-f172.google.com [209.85.220.172]) by mx.google.com with ESMTPS id t1si962692vcx.69.2014.08.06.14.04.50 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 06 Aug 2014 14:04:50 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.220.172 as permitted sender) client-ip=209.85.220.172; Received: by mail-vc0-f172.google.com with SMTP id im17so4963318vcb.31 for ; Wed, 06 Aug 2014 14:04:50 -0700 (PDT) X-Received: by 10.52.156.100 with SMTP id wd4mr224105vdb.39.1407359090099; Wed, 06 Aug 2014 14:04:50 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.221.37.5 with SMTP id tc5csp57085vcb; Wed, 6 Aug 2014 14:04:49 -0700 (PDT) X-Received: by 10.224.8.1 with SMTP id f1mr20956914qaf.89.1407359089337; Wed, 06 Aug 2014 14:04:49 -0700 (PDT) Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id o7si3530717qac.17.2014.08.06.14.04.49 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Wed, 06 Aug 2014 14:04:49 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Received: from localhost ([::1]:41157 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XF8O8-0001bO-Qv for patch@linaro.org; Wed, 06 Aug 2014 17:04:48 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38462) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XF83P-0000Y3-Qo for qemu-devel@nongnu.org; Wed, 06 Aug 2014 16:43:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XF833-0005Nl-JU for qemu-devel@nongnu.org; Wed, 06 Aug 2014 16:43:23 -0400 Received: from e37.co.us.ibm.com ([32.97.110.158]:35001) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XF833-0005NY-CG for qemu-devel@nongnu.org; Wed, 06 Aug 2014 16:43:01 -0400 Received: from /spool/local by e37.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 6 Aug 2014 14:43:00 -0600 Received: from d03dlp02.boulder.ibm.com (9.17.202.178) by e37.co.us.ibm.com (192.168.1.137) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 6 Aug 2014 14:42:59 -0600 Received: from b03cxnp08027.gho.boulder.ibm.com (b03cxnp08027.gho.boulder.ibm.com [9.17.130.19]) by d03dlp02.boulder.ibm.com (Postfix) with ESMTP id 9092B3E4003B; Wed, 6 Aug 2014 14:42:58 -0600 (MDT) Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168]) by b03cxnp08027.gho.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id s76Kfd2d5112144; Wed, 6 Aug 2014 22:41:39 +0200 Received: from d03av02.boulder.ibm.com (localhost [127.0.0.1]) by d03av02.boulder.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id s76Kgwlp005813; Wed, 6 Aug 2014 14:42:58 -0600 Received: from localhost ([9.80.101.111]) by d03av02.boulder.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id s76KgvOP005763; Wed, 6 Aug 2014 14:42:58 -0600 From: Michael Roth To: qemu-devel@nongnu.org Date: Wed, 6 Aug 2014 15:39:14 -0500 Message-Id: <1407357598-21541-65-git-send-email-mdroth@linux.vnet.ibm.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1407357598-21541-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1407357598-21541-1-git-send-email-mdroth@linux.vnet.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 14080620-7164-0000-0000-000003A2ABF9 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 32.97.110.158 Cc: qemu-stable@nongnu.org Subject: [Qemu-devel] [PATCH 064/108] linux-user: Don't overrun guest buffer in sched_getaffinity X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: mdroth@linux.vnet.ibm.com X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.220.172 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 From: Peter Maydell If the guest's "long" type is smaller than the host's, then our sched_getaffinity wrapper needs to round the buffer size up to a multiple of the host sizeof(long). This means that when we copy the data back from the host buffer to the guest's buffer there might be more than we can fit. Rather than overflowing the guest's buffer, handle this case by returning EINVAL or ignoring the unused extra space, as appropriate. Note that only guests using the syscall interface directly might run into this bug -- the glibc wrappers around it will always use a buffer whose size is a multiple of 8 regardless of guest architecture. Signed-off-by: Peter Maydell Signed-off-by: Riku Voipio (cherry picked from commit be3bd286bc06bb68cdc71748d9dd4edcd57b2b24) Signed-off-by: Michael Roth --- linux-user/syscall.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 9864813..2d28bdb 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -7499,6 +7499,22 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask)); if (!is_error(ret)) { + if (ret > arg2) { + /* More data returned than the caller's buffer will fit. + * This only happens if sizeof(abi_long) < sizeof(long) + * and the caller passed us a buffer holding an odd number + * of abi_longs. If the host kernel is actually using the + * extra 4 bytes then fail EINVAL; otherwise we can just + * ignore them and only copy the interesting part. + */ + int numcpus = sysconf(_SC_NPROCESSORS_CONF); + if (numcpus > arg2 * 8) { + ret = -TARGET_EINVAL; + break; + } + ret = arg2; + } + if (copy_to_user(arg3, mask, ret)) { goto efault; }