From patchwork Tue Jun 17 14:56:58 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Riku Voipio X-Patchwork-Id: 360541 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 0288D140078 for ; Wed, 18 Jun 2014 01:04:38 +1000 (EST) Received: from localhost ([::1]:51222 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wwuw7-0008M0-Hj for incoming@patchwork.ozlabs.org; Tue, 17 Jun 2014 11:04:35 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44004) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wwuoz-0005hb-Q2 for qemu-devel@nongnu.org; Tue, 17 Jun 2014 10:57:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Wwuos-0004RA-Jy for qemu-devel@nongnu.org; Tue, 17 Jun 2014 10:57:13 -0400 Received: from afflict.kos.to ([92.243.29.197]:46260) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wwuos-0004QG-D8 for qemu-devel@nongnu.org; Tue, 17 Jun 2014 10:57:06 -0400 Received: from afflict.kos.to (afflict [92.243.29.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by afflict.kos.to (Postfix) with ESMTPSA id E48CD2658A; Tue, 17 Jun 2014 16:57:03 +0200 (CEST) From: riku.voipio@linaro.org To: qemu-devel@nongnu.org Date: Tue, 17 Jun 2014 17:56:58 +0300 Message-Id: X-Mailer: git-send-email 1.7.10.4 In-Reply-To: References: In-Reply-To: References: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 92.243.29.197 Cc: peter.maydell@linaro.org Subject: [Qemu-devel] [PULL v2 15/17] linux-user: Don't overrun guest buffer in sched_getaffinity X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Peter Maydell If the guest's "long" type is smaller than the host's, then our sched_getaffinity wrapper needs to round the buffer size up to a multiple of the host sizeof(long). This means that when we copy the data back from the host buffer to the guest's buffer there might be more than we can fit. Rather than overflowing the guest's buffer, handle this case by returning EINVAL or ignoring the unused extra space, as appropriate. Note that only guests using the syscall interface directly might run into this bug -- the glibc wrappers around it will always use a buffer whose size is a multiple of 8 regardless of guest architecture. Signed-off-by: Peter Maydell Signed-off-by: Riku Voipio --- linux-user/syscall.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 6efeeff..840ced1 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -7438,6 +7438,22 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask)); if (!is_error(ret)) { + if (ret > arg2) { + /* More data returned than the caller's buffer will fit. + * This only happens if sizeof(abi_long) < sizeof(long) + * and the caller passed us a buffer holding an odd number + * of abi_longs. If the host kernel is actually using the + * extra 4 bytes then fail EINVAL; otherwise we can just + * ignore them and only copy the interesting part. + */ + int numcpus = sysconf(_SC_NPROCESSORS_CONF); + if (numcpus > arg2 * 8) { + ret = -TARGET_EINVAL; + break; + } + ret = arg2; + } + if (copy_to_user(arg3, mask, ret)) { goto efault; }