* [Qemu-devel] [PATCH] Fix buffer overrun in sched_getaffinity
@ 2011-04-12 3:48 Mike McCormack
2011-04-16 9:16 ` Stefan Hajnoczi
0 siblings, 1 reply; 3+ messages in thread
From: Mike McCormack @ 2011-04-12 3:48 UTC (permalink / raw)
To: qemu-devel
Zeroing of the cpu array should start from &cpus[kernel_ret]
not &cpus[num_zeros_to_fill].
This fixes a crash in EFL's edje_cc running under qemu-arm.
Signed-off-by: Mike McCormack <mj.mccormack@samsung.com>
---
linux-user/syscall.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index bb0999d..1cda10a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
unsigned long zero = arg2 - ret;
p = alloca(zero);
memset(p, 0, zero);
- if (copy_to_user(arg3 + zero, p, zero)) {
+ if (copy_to_user(arg3 + ret, p, zero)) {
goto efault;
}
arg2 = ret;
--
1.7.0.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] Fix buffer overrun in sched_getaffinity
2011-04-12 3:48 [Qemu-devel] [PATCH] Fix buffer overrun in sched_getaffinity Mike McCormack
@ 2011-04-16 9:16 ` Stefan Hajnoczi
2011-04-16 18:18 ` Mike Frysinger
0 siblings, 1 reply; 3+ messages in thread
From: Stefan Hajnoczi @ 2011-04-16 9:16 UTC (permalink / raw)
To: Mike McCormack; +Cc: Riku Voipio, Mike Frysinger, qemu-devel
On Tue, Apr 12, 2011 at 12:48:20PM +0900, Mike McCormack wrote:
> Zeroing of the cpu array should start from &cpus[kernel_ret]
> not &cpus[num_zeros_to_fill].
>
> This fixes a crash in EFL's edje_cc running under qemu-arm.
>
> Signed-off-by: Mike McCormack <mj.mccormack@samsung.com>
> ---
> linux-user/syscall.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index bb0999d..1cda10a 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
> unsigned long zero = arg2 - ret;
> p = alloca(zero);
> memset(p, 0, zero);
> - if (copy_to_user(arg3 + zero, p, zero)) {
> + if (copy_to_user(arg3 + ret, p, zero)) {
> goto efault;
> }
> arg2 = ret;
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Note that mainline Linux does not zero unwritten bytes. I would drop
the entire arg2 > ret case and instead copy only ret bytes to user.
Stefan
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] Fix buffer overrun in sched_getaffinity
2011-04-16 9:16 ` Stefan Hajnoczi
@ 2011-04-16 18:18 ` Mike Frysinger
0 siblings, 0 replies; 3+ messages in thread
From: Mike Frysinger @ 2011-04-16 18:18 UTC (permalink / raw)
To: Stefan Hajnoczi; +Cc: Mike McCormack, Riku Voipio, qemu-devel
On Sat, Apr 16, 2011 at 05:16, Stefan Hajnoczi wrote:
> On Tue, Apr 12, 2011 at 12:48:20PM +0900, Mike McCormack wrote:
>> Zeroing of the cpu array should start from &cpus[kernel_ret]
>> not &cpus[num_zeros_to_fill].
>>
>> This fixes a crash in EFL's edje_cc running under qemu-arm.
>>
>> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
>> index bb0999d..1cda10a 100644
>> --- a/linux-user/syscall.c
>> +++ b/linux-user/syscall.c
>> @@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
>> unsigned long zero = arg2 - ret;
>> p = alloca(zero);
>> memset(p, 0, zero);
>> - if (copy_to_user(arg3 + zero, p, zero)) {
>> + if (copy_to_user(arg3 + ret, p, zero)) {
>> goto efault;
>> }
>> arg2 = ret;
>
> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
>
> Note that mainline Linux does not zero unwritten bytes. I would drop
> the entire arg2 > ret case and instead copy only ret bytes to user.
both changes make sense to me
Acked-by: Mike Frysinger <vapier@gentoo.org>
-mike
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-04-16 18:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-04-12 3:48 [Qemu-devel] [PATCH] Fix buffer overrun in sched_getaffinity Mike McCormack
2011-04-16 9:16 ` Stefan Hajnoczi
2011-04-16 18:18 ` Mike Frysinger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).