From patchwork Thu May 15 13:40:23 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 30259 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-oa0-f72.google.com (mail-oa0-f72.google.com [209.85.219.72]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 6A2FF202E6 for ; Thu, 15 May 2014 13:41:04 +0000 (UTC) Received: by mail-oa0-f72.google.com with SMTP id l6sf5449167oag.3 for ; Thu, 15 May 2014 06:41:04 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:date :message-id:cc:subject:precedence:list-id:list-unsubscribe :list-archive:list-post:list-help:list-subscribe:errors-to:sender :x-original-sender:x-original-authentication-results:mailing-list; bh=gf7KHxIo3W7S4JP3U/qvL2xPU1tJnv3U7rRzZ2kIc0A=; b=NTb141hpFpLb5cBOL/dFi5JLAqwG8FWrDOD+w2YvitVd+77KI5P4pCHeZkocWULN6o 2FICi5njASX57s5OOsozxm6FFoZtNAZ4fzIZz2+n5YcP+imQl0L6+2yfiAmaVmrXQjoI kic7lXxXO2FQSeGR1OrPz85H1jNdl5ARI7FFZzpKFCMtmZGR0cWGQOR9zhmUhmDZZlc3 W4MOE6oNFHNCCkPJ+SRk6LvbyqYS/a0oKOyZsflejI1NWsN0TTVQ4jOQF2QGCvuJ1OLc pPbuzP1p2LwHe5gJ/QLY+0DLc7f0vwpRz/Tx6kJGINLl4ozeBCn/JwYeolVNVS7CSJ53 0ZlQ== X-Gm-Message-State: ALoCoQn1Wunhk9Mk8uXZdZNzMexxYEn8eejFR6sTRejESM/KbFMS6H/8jLclzLL3sU7MwNDwtQT3 X-Received: by 10.43.67.67 with SMTP id xt3mr4193540icb.23.1400161264031; Thu, 15 May 2014 06:41:04 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.140.16.173 with SMTP id 42ls247340qgb.62.gmail; Thu, 15 May 2014 06:41:03 -0700 (PDT) X-Received: by 10.52.241.98 with SMTP id wh2mr1510762vdc.37.1400161263936; Thu, 15 May 2014 06:41:03 -0700 (PDT) Received: from mail-vc0-f179.google.com (mail-vc0-f179.google.com [209.85.220.179]) by mx.google.com with ESMTPS id p8si943371vef.176.2014.05.15.06.41.03 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 15 May 2014 06:41:03 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.220.179 as permitted sender) client-ip=209.85.220.179; Received: by mail-vc0-f179.google.com with SMTP id im17so4323268vcb.24 for ; Thu, 15 May 2014 06:41:03 -0700 (PDT) X-Received: by 10.220.176.68 with SMTP id bd4mr324344vcb.70.1400161263850; Thu, 15 May 2014 06:41:03 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.220.221.72 with SMTP id ib8csp323516vcb; Thu, 15 May 2014 06:41:03 -0700 (PDT) X-Received: by 10.224.67.131 with SMTP id r3mr13239152qai.75.1400161263351; Thu, 15 May 2014 06:41:03 -0700 (PDT) Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id x5si2558647qcs.31.2014.05.15.06.41.03 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Thu, 15 May 2014 06:41:03 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Received: from localhost ([::1]:58176 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WkvuB-0001sR-1g for patch@linaro.org; Thu, 15 May 2014 09:41:03 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42679) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wkvta-0001bs-Sg for qemu-devel@nongnu.org; Thu, 15 May 2014 09:40:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WkvtZ-0005VZ-RO for qemu-devel@nongnu.org; Thu, 15 May 2014 09:40:26 -0400 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:48156) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WkvtZ-0005VP-Kn for qemu-devel@nongnu.org; Thu, 15 May 2014 09:40:25 -0400 Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.80) (envelope-from ) id 1WkvtX-0007vc-VI; Thu, 15 May 2014 14:40:23 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Date: Thu, 15 May 2014 14:40:23 +0100 Message-Id: <1400161223-30451-1-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.7.10.4 X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2001:8b0:1d0::1 Cc: Riku Voipio Subject: [Qemu-devel] [PATCH] linux-user: Don't overrun guest buffer in sched_getaffinity X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: peter.maydell@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.220.179 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 If the guest's "long" type is smaller than the host's, then our sched_getaffinity wrapper needs to round the buffer size up to a multiple of the host sizeof(long). This means that when we copy the data back from the host buffer to the guest's buffer there might be more than we can fit. Rather than overflowing the guest's buffer, handle this case by returning EINVAL or ignoring the unused extra space, as appropriate. Note that only guests using the syscall interface directly might run into this bug -- the glibc wrappers around it will always use a buffer whose size is a multiple of 8 regardless of guest architecture. Signed-off-by: Peter Maydell --- linux-user/syscall.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 6efeeff..840ced1 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -7438,6 +7438,22 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask)); if (!is_error(ret)) { + if (ret > arg2) { + /* More data returned than the caller's buffer will fit. + * This only happens if sizeof(abi_long) < sizeof(long) + * and the caller passed us a buffer holding an odd number + * of abi_longs. If the host kernel is actually using the + * extra 4 bytes then fail EINVAL; otherwise we can just + * ignore them and only copy the interesting part. + */ + int numcpus = sysconf(_SC_NPROCESSORS_CONF); + if (numcpus > arg2 * 8) { + ret = -TARGET_EINVAL; + break; + } + ret = arg2; + } + if (copy_to_user(arg3, mask, ret)) { goto efault; }