Skip to contentSkip to conversation

Fix buffer overrun in sched_getaffinity

PATCH In review Mike McCormack 3 participants 3 messages Apr 12, 2011 – Apr 16, 2011

lore
Share & tools
lore

Mike McCormack

author
#0 lore raw

PATCH 1/1 Fix buffer overrun in sched_getaffinity

Zeroing of the cpu array should start from &cpus[kernel_ret] not &cpus[num_zeros_to_fill].

This fixes a crash in EFL's edje_cc running under qemu-arm.

Signed-off-by Mike McCormack <[email protected]>
---
 linux-user/syscall.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
linux-user/syscall.c +1 -1
index bb0999d..1cda10a 100644
@@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                     unsigned long zero = arg2 - ret;
                     p = alloca(zero);
                     memset(p, 0, zero);
-                    if (copy_to_user(arg3 + zero, p, zero)) {
+                    if (copy_to_user(arg3 + ret, p, zero)) {
                         goto efault;
                     }
                     arg2 = ret;
Signature · 1 line
1.7.0.4
Reviewed-by on v1 1/1
#1 lore raw
Quoted 15 lines · Mike McCormack

Zeroing of the cpu array should start from &cpus[kernel_ret] not &cpus[num_zeros_to_fill].

This fixes a crash in EFL's edje_cc running under qemu-arm.

Signed-off-by Mike McCormack <[email protected]>
---
 linux-user/syscall.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
linux-user/syscall.c +0 -0
index bb0999d..1cda10a 100644

linux-user/syscall.c abi_long do_syscall(void *cpu_env, int num, abi_long arg1, · line 6395

Quoted 8 lines
linux-user/syscall.c +1 -1
@@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                     unsigned long zero = arg2 - ret;
                     p = alloca(zero);
                     memset(p, 0, zero);
-                    if (copy_to_user(arg3 + zero, p, zero)) {
+                    if (copy_to_user(arg3 + ret, p, zero)) {
                         goto efault;
                     }
                     arg2 = ret;
Reviewed-by Stefan Hajnoczi <[email protected]>

Note that mainline Linux does not zero unwritten bytes. I would drop the entire arg2 > ret case and instead copy only ret bytes to user.

Stefan

Acked-by
#2 lore raw
Quoted 22 lines · Stefan Hajnoczi
Quoted 10 lines · Mike McCormack

Zeroing of the cpu array should start from &cpus[kernel_ret] not &cpus[num_zeros_to_fill].

This fixes a crash in EFL's edje_cc running under qemu-arm.

linux-user/syscall.c +0 -0
index bb0999d..1cda10a 100644

linux-user/syscall.c abi_long do_syscall(void *cpu_env, int num, abi_long arg1, · line 6395

Quoted 8 lines
linux-user/syscall.c +1 -1
@@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                      unsigned long zero = arg2 - ret;
                      p = alloca(zero);
                      memset(p, 0, zero);
-                    if (copy_to_user(arg3 + zero, p, zero)) {
+                    if (copy_to_user(arg3 + ret, p, zero)) {
                          goto efault;
                      }
                      arg2 = ret;
Reviewed-by Stefan Hajnoczi <[email protected]>
Quoted 2 lines

Note that mainline Linux does not zero unwritten bytes.  I would drop the entire arg2 > ret case and instead copy only ret bytes to user.

both changes make sense to me

Acked-by Mike Frysinger <[email protected]>

-mike