[PATCH] sendfile compat functions on x86_64 and ia64

Alexey Toptygin
2006-05-05T00:45:59Z

Hi,

I'm a kernel noob, so I apologise in advance if I completely misunderstood
something. In arch/x86_64/ia32/sys_ia32.c there is this code:

sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, s32 count)
[snip]
ret = sys_sendfile(out_fd, in_fd, offset ? &of : NULL, count);

However on ia32, count (a size_t) is u32. I think this is taking the u32
value from the 32 bit userland, sign-extending it to 64 bits, then giving
it to sys_sendfile in a u64. So, a count >= 1<<31 passed from the 32 bit
app will become a count >= ((1<<33)-1)<<31 given to sys_sendfile.

Now, I don't think this actually hurts anything, because sys_sendfile
passes a max of ((1<<31)-1) to do_sendfile, plus rw_verify_area will
reject values that are negative when cast to ssize_t; but, this is
certainly confusing.

Perhaps that s32 should be changed to a compat_size_t? ISTM that's
what compat_size_t is for. And if so, the equivalent function in
arch/ia64/ia32/sys_ia32.c:

sys32_sendfile (int out_fd, int in_fd, int __user *offset, unsigned int count)

should probably be changed as well? In case I'm not completely wrong,
below is a patch. Please CC: me, I'm not on lkml.

Signed-off-by: Alexey Toptygin <alexeyt@freeshell.org>

diff -urpN linux-source-2.6.16/arch/ia64/ia32/sys_ia32.c linux-source-2.6.16-mine/arch/ia64/ia32/sys_ia32.c
--- linux-source-2.6.16/arch/ia64/ia32/sys_ia32.c 2006-03-20 00:53:29.000000000 -0500
+++ linux-source-2.6.16-mine/arch/ia64/ia32/sys_ia32.c 2006-05-04 20:20:44.000000000 -0400
@@ -2306,7 +2306,8 @@ sys32_pwrite (unsigned int fd, void __us
}

asmlinkage long
-sys32_sendfile (int out_fd, int in_fd, int __user *offset, unsigned int count)
+sys32_sendfile (int out_fd, int in_fd, compat_off_t __user *offset,
+ compat_size_t count)
{
mm_segment_t old_fs = get_fs();
long ret;
diff -urpN linux-source-2.6.16/arch/x86_64/ia32/sys_ia32.c linux-source-2.6.16-mine/arch/x86_64/ia32/sys_ia32.c
--- linux-source-2.6.16/arch/x86_64/ia32/sys_ia32.c 2006-03-20 00:53:29.000000000 -0500
+++ linux-source-2.6.16-mine/arch/x86_64/ia32/sys_ia32.c 2006-05-04 20:19:35.000000000 -0400
@@ -760,7 +760,8 @@ sys32_personality(unsigned long personal
}

asmlinkage long
-sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, s32 count)
+sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset,
+ compat_size_t count)
{
mm_segment_t old_fs = get_fs();
int ret;