From patchwork Mon Jun 9 12:46:40 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Riku Voipio X-Patchwork-Id: 31556 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-ig0-f199.google.com (mail-ig0-f199.google.com [209.85.213.199]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 08E1920675 for ; Mon, 9 Jun 2014 12:53:48 +0000 (UTC) Received: by mail-ig0-f199.google.com with SMTP id h18sf967286igc.6 for ; Mon, 09 Jun 2014 05:53:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:date :message-id:in-reply-to:references:cc:subject:precedence:list-id :list-unsubscribe:list-archive:list-post:list-help:list-subscribe :errors-to:sender:x-original-sender :x-original-authentication-results:mailing-list; bh=ZKb++qkORpXfwmOzoxYT2SPPDzJZ4+byRnYsX9FEgkc=; b=Wfc6FSfWzYyGVJPw1aDGNXgVwgtaIcRvZOVgm+AUNVjQX0GILeKhAjdCWGIg8Kqi// EfzW6Gq8xApAUvcyiCcLy1ivvj/vb5ejlgGXWFZprtvJpMQTCMvAr//NF3YRjbZcBao3 h9A9/dxmBc0LWbOznvsCbR6/ByHFDREfzrJFzgYfKhPIASFCHhxSWyAoFMbCiSUwQjld tFd+cVhDGm8ASCN12cm2Aatu3EuAnnvE2DtGbJbsNlbb5vRh+p328kZOjj35HHLhwpqu eHFsVsjen50AtCkhTVOg/vSCUQDk3DcBsQEcGmM/uwezyc/DY1E/krCLmwuOhHW+hzZj O0QA== X-Gm-Message-State: ALoCoQkdmuOwuyHibNJEiUkmdinVxPyKe1HRaZ2bDB38S8idrXXZtbxTgTzwffXK08YS+Eipc6ud X-Received: by 10.182.106.229 with SMTP id gx5mr12984317obb.31.1402318428529; Mon, 09 Jun 2014 05:53:48 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.140.105.54 with SMTP id b51ls1577927qgf.48.gmail; Mon, 09 Jun 2014 05:53:48 -0700 (PDT) X-Received: by 10.58.29.198 with SMTP id m6mr25729721veh.15.1402318427958; Mon, 09 Jun 2014 05:53:47 -0700 (PDT) Received: from mail-ve0-f169.google.com (mail-ve0-f169.google.com [209.85.128.169]) by mx.google.com with ESMTPS id dn3si10571421vcb.40.2014.06.09.05.53.47 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 09 Jun 2014 05:53:47 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.128.169 as permitted sender) client-ip=209.85.128.169; Received: by mail-ve0-f169.google.com with SMTP id pa12so74602veb.0 for ; Mon, 09 Jun 2014 05:53:47 -0700 (PDT) X-Received: by 10.220.53.72 with SMTP id l8mr25835395vcg.16.1402318427890; Mon, 09 Jun 2014 05:53:47 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.221.54.6 with SMTP id vs6csp143638vcb; Mon, 9 Jun 2014 05:53:47 -0700 (PDT) X-Received: by 10.140.43.100 with SMTP id d91mr30892681qga.11.1402318427006; Mon, 09 Jun 2014 05:53:47 -0700 (PDT) Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id i111si22948026qge.31.2014.06.09.05.53.46 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 09 Jun 2014 05:53:47 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Received: from localhost ([::1]:60902 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wtz58-0007Lj-Mf for patch@linaro.org; Mon, 09 Jun 2014 08:53:46 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44951) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WtyyU-0005cb-W6 for qemu-devel@nongnu.org; Mon, 09 Jun 2014 08:47:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WtyyN-0007hd-8t for qemu-devel@nongnu.org; Mon, 09 Jun 2014 08:46:54 -0400 Received: from [2001:4b98:dc0:45:216:3eff:fe3d:166f] (port=55290 helo=afflict.kos.to) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WtyyN-0007gR-1a for qemu-devel@nongnu.org; Mon, 09 Jun 2014 08:46:47 -0400 Received: from afflict.kos.to (afflict [92.243.29.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by afflict.kos.to (Postfix) with ESMTPSA id 3B55E2658A; Mon, 9 Jun 2014 14:46:45 +0200 (CEST) From: riku.voipio@linaro.org To: qemu-devel@nongnu.org Date: Mon, 9 Jun 2014 15:46:40 +0300 Message-Id: X-Mailer: git-send-email 1.7.10.4 In-Reply-To: References: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 2001:4b98:dc0:45:216:3eff:fe3d:166f Cc: peter.maydell@linaro.org Subject: [Qemu-devel] [PULL 15/18] linux-user: Don't overrun guest buffer in sched_getaffinity X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: riku.voipio@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.128.169 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 From: Peter Maydell If the guest's "long" type is smaller than the host's, then our sched_getaffinity wrapper needs to round the buffer size up to a multiple of the host sizeof(long). This means that when we copy the data back from the host buffer to the guest's buffer there might be more than we can fit. Rather than overflowing the guest's buffer, handle this case by returning EINVAL or ignoring the unused extra space, as appropriate. Note that only guests using the syscall interface directly might run into this bug -- the glibc wrappers around it will always use a buffer whose size is a multiple of 8 regardless of guest architecture. Signed-off-by: Peter Maydell Signed-off-by: Riku Voipio --- linux-user/syscall.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 6efeeff..840ced1 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -7438,6 +7438,22 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask)); if (!is_error(ret)) { + if (ret > arg2) { + /* More data returned than the caller's buffer will fit. + * This only happens if sizeof(abi_long) < sizeof(long) + * and the caller passed us a buffer holding an odd number + * of abi_longs. If the host kernel is actually using the + * extra 4 bytes then fail EINVAL; otherwise we can just + * ignore them and only copy the interesting part. + */ + int numcpus = sysconf(_SC_NPROCESSORS_CONF); + if (numcpus > arg2 * 8) { + ret = -TARGET_EINVAL; + break; + } + ret = arg2; + } + if (copy_to_user(arg3, mask, ret)) { goto efault; }