From patchwork Fri Sep 9 09:32:29 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Riku Voipio X-Patchwork-Id: 114031 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 74805B700E for ; Fri, 9 Sep 2011 19:32:53 +1000 (EST) Received: from localhost ([::1]:55231 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R1xS5-0005Ru-D6 for incoming@patchwork.ozlabs.org; Fri, 09 Sep 2011 05:32:49 -0400 Received: from eggs.gnu.org ([140.186.70.92]:51685) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R1xRs-0005NS-Vt for qemu-devel@nongnu.org; Fri, 09 Sep 2011 05:32:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1R1xRr-0007Wx-0C for qemu-devel@nongnu.org; Fri, 09 Sep 2011 05:32:36 -0400 Received: from afflict.kos.to ([92.243.29.197]:60304) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R1xRq-0007Wn-Nm for qemu-devel@nongnu.org; Fri, 09 Sep 2011 05:32:34 -0400 Received: by afflict.kos.to (Postfix, from userid 1000) id E4567266CA; Fri, 9 Sep 2011 09:32:31 +0000 (UTC) From: riku.voipio@linaro.org To: qemu-devel@nongnu.org Date: Fri, 9 Sep 2011 12:32:29 +0300 Message-Id: <94c19610a6973ad917d9c154eabfc2ee27bc4f59.1315560307.git.riku.voipio@linaro.org> X-Mailer: git-send-email 1.7.1 In-Reply-To: References: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-Received-From: 92.243.29.197 Cc: An-Cheng Huang Subject: [Qemu-devel] [PATCH 5/7] linux-user: Verify MIPS syscall arguments X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: An-Cheng Huang On MIPS, some syscall arguments are taken from the stack. This patch adds verification such that do_syscall() is only invoked if all arguments have been successfully taken from the stack. Signed-off-by: Riku Voipio Reviewed-by: Peter Maydell Signed-off-by: An-Cheng Huang --- linux-user/main.c | 22 +++++++++++++++++----- 1 files changed, 17 insertions(+), 5 deletions(-) diff --git a/linux-user/main.c b/linux-user/main.c index 3df91f3..0cc9148 100644 --- a/linux-user/main.c +++ b/linux-user/main.c @@ -2170,11 +2170,22 @@ void cpu_loop(CPUMIPSState *env) sp_reg = env->active_tc.gpr[29]; switch (nb_args) { /* these arguments are taken from the stack */ - /* FIXME - what to do if get_user() fails? */ - case 8: get_user_ual(arg8, sp_reg + 28); - case 7: get_user_ual(arg7, sp_reg + 24); - case 6: get_user_ual(arg6, sp_reg + 20); - case 5: get_user_ual(arg5, sp_reg + 16); + case 8: + if ((ret = get_user_ual(arg8, sp_reg + 28)) != 0) { + goto done_syscall; + } + case 7: + if ((ret = get_user_ual(arg7, sp_reg + 24)) != 0) { + goto done_syscall; + } + case 6: + if ((ret = get_user_ual(arg6, sp_reg + 20)) != 0) { + goto done_syscall; + } + case 5: + if ((ret = get_user_ual(arg5, sp_reg + 16)) != 0) { + goto done_syscall; + } default: break; } @@ -2185,6 +2196,7 @@ void cpu_loop(CPUMIPSState *env) env->active_tc.gpr[7], arg5, arg6, arg7, arg8); } +done_syscall: if (ret == -TARGET_QEMU_ESIGRETURN) { /* Returning from a successful sigreturn syscall. Avoid clobbering register state. */