linux-user: avoid EFAULT when NULL is passed as buffer for [p]write[64]
PATCH 1/1 linux-user: avoid EFAULT when NULL is passed as buffer for [p]write[64]
as documented in write(2)[1], if count is zero and fd refers to a regular file the syscall might return 0 (if error detection is not performed).
the current version of the code will force and EFAULT if the buffer was pointing to NULL and therefore will result in the following call failing:
write(fd, NULL, 0)
instead of failing early, pass the call to the host instead so that any further checks could be done there and the documented shortcut could be used.
[1] http://man7.org/linux/man-pages/man2/write.2.html#RETURN_VALUE
Reported-by Zhuowei Zhang <[email protected]>
Signed-off-by Carlo Marcelo Arenas Belón <[email protected]>
--- linux-user/syscall.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
linux-user/syscall.c +7 -3
@@ -7783,8 +7783,10 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, }break ;case TARGET_NR_write: -if (!(p =lock_user (VERIFY_READ , arg2, arg3,1 ))) + p =lock_user (VERIFY_READ , arg2, arg3,1 ); +if ((p ==NULL ) && (arg2 !=0 )) { goto efault; + }if (fd_trans_target_to_host_data (arg1)) {void *copy =g_malloc (arg3);memcpy (copy, p, arg3);
@@ -10505,12 +10507,14 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,unlock_user (p, arg2, ret);break ;case TARGET_NR_pwrite64: + p =lock_user (VERIFY_READ , arg2, arg3,1 ); +if ((p ==NULL ) && (arg2 !=0 )) { + goto efault; + }if (regpairs_aligned (cpu_env)) { arg4 = arg5; arg5 = arg6; } -if (!(p =lock_user (VERIFY_READ , arg2, arg3,1 ))) - goto efault; ret =get_errno (pwrite64 (arg1, p, arg3,target_offset64 (arg4, arg5)));unlock_user (p, arg2,0 );break ;
Signature · 1 line
2.14.2