Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kernel: vfs: common_fcntl() now uses memcpy() for kernel calls.

Browse Source 
instead of user_memcpy().

* fix #14204: the NTFS filesystem kernel addon uses the fcntl system call to
lock the underlying device. The user_memcpy replacement in the x86 compat
branch adds range checks for the user pointer, which exposes such problems.
This commit is contained in:
Jérôme Duval 2018-06-30 15:27:11 +02:00
parent 65df4b51f5
commit 4f5ed463b5
1 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/system/kernel/fs/vfs.cpp
View File

@ -6116,10 +6116,11 @@ common_fcntl(int fd, int op, size_t argument, bool kernel)
if (op == F_SETLK || op == F_SETLKW || op == F_GETLK) {
if (descriptor->type != FDTYPE_FILE)
status = B_BAD_VALUE;
else if (kernel)
memcpy(&flock, (struct flock*)argument, sizeof(struct flock));
else if (user_memcpy(&flock, (struct flock*)argument,
sizeof(struct flock)) != B_OK)
status = B_BAD_ADDRESS;
if (status != B_OK) {
put_fd(descriptor);
return status;
@ -6208,16 +6209,26 @@ common_fcntl(int fd, int op, size_t argument, bool kernel)
// no conflicting lock found, copy back the same struct
// we were given except change type to F_UNLCK
flock.l_type = F_UNLCK;
status = user_memcpy((struct flock*)argument, &flock,
sizeof(struct flock));
if (kernel) {
memcpy((struct flock*)argument, &flock,
sizeof(struct flock));
} else {
status = user_memcpy((struct flock*)argument,
&flock, sizeof(struct flock));
}
} else {
// a conflicting lock was found, copy back its range and
// type
if (normalizedLock.l_len == OFF_MAX)
normalizedLock.l_len = 0;
status = user_memcpy((struct flock*)argument,
&normalizedLock, sizeof(struct flock));
if (kernel) {
memcpy((struct flock*)argument,
&normalizedLock, sizeof(struct flock));
} else {
status = user_memcpy((struct flock*)argument,
&normalizedLock, sizeof(struct flock));
}
}
}
} else