Ioctl in 2.6.35.22 change the argument value?

Ioctl in 2.6.35.22 change the argument value?

[孙子荀]

Hello everybody,

When I want to get the block size about the block device(DM or real),I
use the system API like "ioctl(int fd, BLKGETSIZE,long size)".
Everything works fine. But when I pass the third parameter whose type
is "int", the first parameter fd will be changed to zero. It only
happened on x86_64 and 2.6.35 ,on  2.6.38 and 32bit will not occur,
I've already tested on them.
(My PC:Linux server-group 2.6.35-22-server #33-Ubuntu SMP Sun Sep 19
20:48:58 UTC 2010 x86_64 GNU/Linux)
here is the test code:
int main(){
        int fd;
        int blksize ;
        fd = open("/dev/sda",O_RDONLY,0);
        ioctl(fd, BLKGETSIZE,&blksize) ;
        close(fd);
}
If I change the fd type as long , won't occur again. I quite sure the
ioctl syscall when return from userspace changes the fd's value.
(gdb) r
Starting program: /home/test/main
10              fd = open("/dev/sda",O_RDONLY,0);
(gdb)
   0x00000000004005a7 <+35>:    callq  0x400490 <open@plt>
   0x00000000004005ac <+40>:    mov    %eax,-0x4(%rbp)
   0x00000000004005af <+43>:    lea    -0x8(%rbp),%rdx
   0x00000000004005b3 <+47>:    mov    -0x4(%rbp),%eax
   0x00000000004005b6 <+50>:    mov    $0x1260,%esi
=> 0x00000000004005bb <+55>:    mov    %eax,%edi
   0x00000000004005bd <+57>:    mov    $0x0,%eax
   0x00000000004005c2 <+62>:    callq  0x400470 <ioctl@plt>
   0x00000000004005c7 <+67>:    mov    -0x4(%rbp),%eax
(gdb) ni
0x00000000004005bd      11              ioctl(fd, BLKGETSIZE,&blksize) ;
(gdb) p $edi
$1 = 5
(gdb) n
12              close(fd);
(gdb) p $edi
$3 = 5
(gdb) p fd
$4 = 0
And I also find that in the function :
"int blkdev_ioctl(struct block_device *bdev, fmode_t mode, unsigned
cmd,unsigned long arg)"
If it's case which  return put_uint() will be fine ,I mean the fd, and
that was opposite to the case which  return put_long();
Dose anybody now which path after 2.6.35 slove the problem ?I just
guess about restore_all(arch/x86/include/). thanks a lot!
I will be gratefull for u help. Thanks a lot. Thanks a million!
--
Regards,
Sri.
--
2011-06-30

--------------------------------------------------------------------------------

faye.zixun

Re: Ioctl in 2.6.35.22 change the argument value?

[孙子荀]

Hello everybody,

When I want to get the block size about the block device(DM or real),I
use the system API like "ioctl(int fd, BLKGETSIZE,long size)".
Everything works fine. But when I pass the third parameter whose type
is "int", the first parameter fd will be changed to zero. It only
happened on x86_64 and 2.6.35 ,on  2.6.38 and 32bit will not occur,
I've already tested on them.
(My PC:Linux server-group 2.6.35-22-server #33-Ubuntu SMP Sun Sep 19
20:48:58 UTC 2010 x86_64 GNU/Linux)
here is the test code:
int main(){
        int fd;
        int blksize ;
        fd = open("/dev/sda",O_RDONLY,0);
        ioctl(fd, BLKGETSIZE,&blksize) ;
        close(fd);
}
If I change the fd type as long( int fd ==> long fd ) , won't occur
again. I quite sure the ioctl syscall when return to userspace changes
the fd's value.
(gdb) r
Starting program: /home/test/main
10              fd = open("/dev/sda",O_RDONLY,0);
(gdb)
   0x00000000004005a7 <+35>:    callq  0x400490 <open@plt>
   0x00000000004005ac <+40>:    mov    %eax,-0x4(%rbp)
   0x00000000004005af <+43>:    lea    -0x8(%rbp),%rdx
   0x00000000004005b3 <+47>:    mov    -0x4(%rbp),%eax
   0x00000000004005b6 <+50>:    mov    $0x1260,%esi
=> 0x00000000004005bb <+55>:    mov    %eax,%edi
   0x00000000004005bd <+57>:    mov    $0x0,%eax
   0x00000000004005c2 <+62>:    callq  0x400470 <ioctl@plt>
   0x00000000004005c7 <+67>:    mov    -0x4(%rbp),%eax
(gdb) ni
0x00000000004005bd      11              ioctl(fd, BLKGETSIZE,&blksize) ;
(gdb) p $edi
$1 = 5
(gdb) n
12              close(fd);
(gdb) p $edi
$3 = 5
(gdb) p fd
$4 = 0
And I also find that in the function :
"int blkdev_ioctl(struct block_device *bdev, fmode_t mode, unsigned
cmd,unsigned long arg)"
If it's case<BLKBSZGET BLKPBSZGET> which  return put_uint() will be
fine ,I mean the fd, and that was opposite to the case<BLKGETSIZE
BLKGETSIZE64> which  return put_long() ;
Dose anybody now which patch after 2.6.35 slove the problem ?I just
guess about restore_all(arch/x86/include/). thanks a lot!
I will be gratefull for u help. Thanks a lot. Thanks a million!
--
Regards,
Sri.
--
2011-06-30

--------------------------------------------------------------------------------

faye.zixun

Re: [stable] Ioctl in 2.6.35.22 change the argument value?

[Willy Tarreau]

Hello,

On Wed, Jun 29, 2011 at 11:09:26PM -0700, ????????? wrote:
> Hello everybody,
> 
> When I want to get the block size about the block device(DM or real),I
> use the system API like "ioctl(int fd, BLKGETSIZE,long size)".
> Everything works fine. But when I pass the third parameter whose type
> is "int", the first parameter fd will be changed to zero. It only
> happened on x86_64 and 2.6.35 ,on  2.6.38 and 32bit will not occur,
> I've already tested on them.
> (My PC:Linux server-group 2.6.35-22-server #33-Ubuntu SMP Sun Sep 19
> 20:48:58 UTC 2010 x86_64 GNU/Linux)
> here is the test code:
> int main(){
>         int fd;
>         int blksize ;
>         fd = open("/dev/sda",O_RDONLY,0);
>         ioctl(fd, BLKGETSIZE,&blksize) ;
>         close(fd);
> }
> If I change the fd type as long( int fd ==> long fd ) , won't occur
> again. I quite sure the ioctl syscall when return to userspace changes
> the fd's value.

This is expected, check the ioctl list (man ioctl_list) :
       0x00001260   BLKGETSIZE   unsigned long *

So it returns a long, and you need to have blksize declared as long
and not as int. On 32-bit systems, both are the same size so your
bug has no effect.

Please also note that this is irrelevant to the stable list.

Regards,
Willy