mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux-user: Fix getdents emulation for 64 bit guest on 32 bit host

Browse Source 
Currently we mishandle emulation of the getdents syscall for the
case of a 64 bit guest on a 32 bit host -- it defaults into
the 'host and guest same size' codepath and generates incorrect
structures in the guest buffer.

We can't easily handle the 64-on-32 case using the host getdents
syscall, because the guest struct dirent is bigger than the
host struct dirent, and we might find the host syscall has handed
us back more records than we can fit in the guest buffer after
conversion. Instead, always emulate 64-on-32 getdents with
the host getdents64. This avoids the buffer-overrun problem
because a dirent64 struct is always the same size on any host
and always larger than any architecture's dirent struct.

Reported-by: Henry Wertz <hwertz10@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20180419125740.2695-1-peter.maydell@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This commit is contained in:
Peter Maydell 2018-04-19 13:57:40 +01:00 committed by Laurent Vivier
parent b02ebad1dc
commit 2b3f64cbf3
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
linux-user/syscall.c
View File

@ -259,10 +259,22 @@ static int gettid(void) {
return -ENOSYS; return -ENOSYS;
} }
#endif #endif
#if defined(TARGET_NR_getdents) && defined(__NR_getdents)
/* For the 64-bit guest on 32-bit host case we must emulate
* getdents using getdents64, because otherwise the host
* might hand us back more dirent records than we can fit
* into the guest buffer after structure format conversion.
* Otherwise we emulate getdents with getdents if the host has it.
*/
#if defined(__NR_getdents) && HOST_LONG_BITS >= TARGET_ABI_BITS
#define EMULATE_GETDENTS_WITH_GETDENTS
#endif
#if defined(TARGET_NR_getdents) && defined(EMULATE_GETDENTS_WITH_GETDENTS)
_syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count); _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
#endif #endif
#if !defined(__NR_getdents) || \ #if (defined(TARGET_NR_getdents) && \
!defined(EMULATE_GETDENTS_WITH_GETDENTS)) || \
(defined(TARGET_NR_getdents64) && defined(__NR_getdents64)) (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
_syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count); _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
#endif #endif
@ -10163,7 +10175,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
#endif #endif
#ifdef TARGET_NR_getdents #ifdef TARGET_NR_getdents
case TARGET_NR_getdents: case TARGET_NR_getdents:
#ifdef __NR_getdents #ifdef EMULATE_GETDENTS_WITH_GETDENTS
#if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64 #if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
{ {
struct target_dirent *target_dirp; struct target_dirent *target_dirp;