mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux-user: Don't overrun guest buffer in sched_getaffinity

Browse Source 
If the guest's "long" type is smaller than the host's, then
our sched_getaffinity wrapper needs to round the buffer size
up to a multiple of the host sizeof(long). This means that when
we copy the data back from the host buffer to the guest's
buffer there might be more than we can fit. Rather than
overflowing the guest's buffer, handle this case by returning
EINVAL or ignoring the unused extra space, as appropriate.

Note that only guests using the syscall interface directly might
run into this bug -- the glibc wrappers around it will always
use a buffer whose size is a multiple of 8 regardless of guest
architecture.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
This commit is contained in:
Peter Maydell 2014-05-15 14:40:23 +01:00 committed by Riku Voipio
parent 4d13be8b8b
commit be3bd286bc
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
linux-user/syscall.c
View File

@ -7438,6 +7438,22 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
if (!is_error(ret)) {
if (ret > arg2) {
/* More data returned than the caller's buffer will fit.
* This only happens if sizeof(abi_long) < sizeof(long)
* and the caller passed us a buffer holding an odd number
* of abi_longs. If the host kernel is actually using the
* extra 4 bytes then fail EINVAL; otherwise we can just
* ignore them and only copy the interesting part.
*/
int numcpus = sysconf(_SC_NPROCESSORS_CONF);
if (numcpus > arg2 * 8) {
ret = -TARGET_EINVAL;
break;
}
ret = arg2;
}
if (copy_to_user(arg3, mask, ret)) {
goto efault;
}