From: Stuart Anderson <anderson@netsweng.com>
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] RCF: [2/11] EFAULT patch
Date: Tue, 18 Sep 2007 21:09:20 -0400 (EDT) [thread overview]
Message-ID: <Pine.LNX.4.64.0709182105040.20150@trantor.stuart.netsweng.com> (raw)
[-- Attachment #1: Type: TEXT/PLAIN, Size: 697 bytes --]
In this section, the functions for reading and writing fdsets, reading
rusage, and reading and writing timevals have been updated to use the
new kernel like interfaces.
Also, places where these function have been used are adjusted to match,
this includes do_select(), and the do_syscall() code for getrusage(),
gettimeofday(), settimeofday() and setitimer().
Stuart
Stuart R. Anderson anderson@netsweng.com
Network & Software Engineering http://www.netsweng.com/
1024D/37A79149: 0791 D3B8 9A4C 2CDC A31F
BD03 0A62 E534 37A7 9149
[-- Attachment #2: efault patch 2 of 11 --]
[-- Type: TEXT/PLAIN, Size: 12528 bytes --]
Index: qemu/linux-user/syscall.c
===================================================================
--- qemu.orig/linux-user/syscall.c 2007-09-17 16:17:38.000000000 -0400
+++ qemu/linux-user/syscall.c 2007-09-17 21:07:35.000000000 -0400
@@ -363,13 +363,15 @@
}
}
-static inline fd_set *target_to_host_fds(fd_set *fds,
+#define FD_MASK_SIZE (FD_SETSIZE/NFDBITS)
+
+static inline long copy_from_user_fdset(fd_set *fds,
target_long *target_fds, int n)
{
-#if !defined(BSWAP_NEEDED) && !defined(WORDS_BIGENDIAN)
- return (fd_set *)target_fds;
-#else
int i, b;
+
+ if( !access_ok(VERIFY_READ,target_fds,FD_MASK_SIZE) ) return -1;
+
if (target_fds) {
FD_ZERO(fds);
for(i = 0;i < n; i++) {
@@ -378,22 +380,18 @@
if (b)
FD_SET(i, fds);
}
- return fds;
- } else {
- return NULL;
}
-#endif
+ return 0;
}
-static inline void host_to_target_fds(target_long *target_fds,
+static inline long copy_to_user_fdset(target_long *target_fds,
fd_set *fds, int n)
{
-#if !defined(BSWAP_NEEDED) && !defined(WORDS_BIGENDIAN)
- /* nothing to do */
-#else
int i, nw, j, k;
target_long v;
+ if( !access_ok(VERIFY_WRITE,target_fds,FD_MASK_SIZE) ) return -1;
+
if (target_fds) {
nw = (n + TARGET_LONG_BITS - 1) / TARGET_LONG_BITS;
k = 0;
@@ -406,7 +404,7 @@
target_fds[i] = tswapl(v);
}
}
-#endif
+ return 0;
}
#if defined(__alpha__)
@@ -424,53 +422,50 @@
#endif
}
-static inline void host_to_target_rusage(target_ulong target_addr,
+static inline long copy_to_user_rusage(struct target_rusage *target_rusage,
const struct rusage *rusage)
{
- struct target_rusage *target_rusage;
+ if( !access_ok(VERIFY_WRITE,target_rusage,sizeof(*target_rusage)) ) return -1;
+ __put_user(rusage->ru_utime.tv_sec, &target_rusage->ru_utime.tv_sec);
+ __put_user(rusage->ru_utime.tv_usec, &target_rusage->ru_utime.tv_usec);
+ __put_user(rusage->ru_stime.tv_sec, &target_rusage->ru_stime.tv_sec);
+ __put_user(rusage->ru_stime.tv_usec, &target_rusage->ru_stime.tv_usec);
+ __put_user(rusage->ru_maxrss, &target_rusage->ru_maxrss);
+ __put_user(rusage->ru_ixrss, &target_rusage->ru_ixrss);
+ __put_user(rusage->ru_idrss, &target_rusage->ru_idrss);
+ __put_user(rusage->ru_isrss, &target_rusage->ru_isrss);
+ __put_user(rusage->ru_minflt, &target_rusage->ru_minflt);
+ __put_user(rusage->ru_majflt, &target_rusage->ru_majflt);
+ __put_user(rusage->ru_nswap, &target_rusage->ru_nswap);
+ __put_user(rusage->ru_inblock, &target_rusage->ru_inblock);
+ __put_user(rusage->ru_oublock, &target_rusage->ru_oublock);
+ __put_user(rusage->ru_msgsnd, &target_rusage->ru_msgsnd);
+ __put_user(rusage->ru_msgrcv, &target_rusage->ru_msgrcv);
+ __put_user(rusage->ru_nsignals, &target_rusage->ru_nsignals);
+ __put_user(rusage->ru_nvcsw, &target_rusage->ru_nvcsw);
+ __put_user(rusage->ru_nivcsw, &target_rusage->ru_nivcsw);
- lock_user_struct(target_rusage, target_addr, 0);
- target_rusage->ru_utime.tv_sec = tswapl(rusage->ru_utime.tv_sec);
- target_rusage->ru_utime.tv_usec = tswapl(rusage->ru_utime.tv_usec);
- target_rusage->ru_stime.tv_sec = tswapl(rusage->ru_stime.tv_sec);
- target_rusage->ru_stime.tv_usec = tswapl(rusage->ru_stime.tv_usec);
- target_rusage->ru_maxrss = tswapl(rusage->ru_maxrss);
- target_rusage->ru_ixrss = tswapl(rusage->ru_ixrss);
- target_rusage->ru_idrss = tswapl(rusage->ru_idrss);
- target_rusage->ru_isrss = tswapl(rusage->ru_isrss);
- target_rusage->ru_minflt = tswapl(rusage->ru_minflt);
- target_rusage->ru_majflt = tswapl(rusage->ru_majflt);
- target_rusage->ru_nswap = tswapl(rusage->ru_nswap);
- target_rusage->ru_inblock = tswapl(rusage->ru_inblock);
- target_rusage->ru_oublock = tswapl(rusage->ru_oublock);
- target_rusage->ru_msgsnd = tswapl(rusage->ru_msgsnd);
- target_rusage->ru_msgrcv = tswapl(rusage->ru_msgrcv);
- target_rusage->ru_nsignals = tswapl(rusage->ru_nsignals);
- target_rusage->ru_nvcsw = tswapl(rusage->ru_nvcsw);
- target_rusage->ru_nivcsw = tswapl(rusage->ru_nivcsw);
- unlock_user_struct(target_rusage, target_addr, 1);
+ return 0;
}
-static inline void target_to_host_timeval(struct timeval *tv,
- target_ulong target_addr)
+static inline long copy_from_user_timeval(struct timeval *tv,
+ struct target_timeval *target_tv)
{
- struct target_timeval *target_tv;
+ if( !access_ok(VERIFY_READ,target_tv,sizeof(*target_tv)) ) return -1;
+ __get_user(tv->tv_sec, &target_tv->tv_sec);
+ __get_user(tv->tv_usec, &target_tv->tv_usec);
- lock_user_struct(target_tv, target_addr, 1);
- tv->tv_sec = tswapl(target_tv->tv_sec);
- tv->tv_usec = tswapl(target_tv->tv_usec);
- unlock_user_struct(target_tv, target_addr, 0);
+ return 0;
}
-static inline void host_to_target_timeval(target_ulong target_addr,
+static inline long copy_to_user_timeval(struct target_timeval *target_tv,
const struct timeval *tv)
{
- struct target_timeval *target_tv;
+ if( !access_ok(VERIFY_WRITE,target_tv,sizeof(*target_tv)) ) return -1;
+ __put_user(tv->tv_sec, &target_tv->tv_sec);
+ __put_user(tv->tv_usec, &target_tv->tv_usec);
- lock_user_struct(target_tv, target_addr, 0);
- target_tv->tv_sec = tswapl(tv->tv_sec);
- target_tv->tv_usec = tswapl(tv->tv_usec);
- unlock_user_struct(target_tv, target_addr, 1);
+ return 0;
}
@@ -486,29 +481,32 @@
int ok;
if (rfd_p) {
- target_rfds = lock_user(rfd_p, sizeof(target_long) * n, 1);
- rfds_ptr = target_to_host_fds(&rfds, target_rfds, n);
+ if( copy_from_user_fdset(&rfds, rfd_p, n) ) return -EFAULT;
+ rfds_ptr = &rfds;
+ target_rfds = rfd_p;
} else {
target_rfds = NULL;
rfds_ptr = NULL;
}
if (wfd_p) {
- target_wfds = lock_user(wfd_p, sizeof(target_long) * n, 1);
- wfds_ptr = target_to_host_fds(&wfds, target_wfds, n);
+ if( copy_from_user_fdset(&wfds, wfd_p, n) ) return -EFAULT;
+ wfds_ptr = &wfds;
+ target_wfds = wfd_p;
} else {
target_wfds = NULL;
wfds_ptr = NULL;
}
if (efd_p) {
- target_efds = lock_user(efd_p, sizeof(target_long) * n, 1);
- efds_ptr = target_to_host_fds(&efds, target_efds, n);
+ if( copy_from_user_fdset(&efds, efd_p, n) ) return -EFAULT;
+ efds_ptr = &efds;
+ target_efds = efd_p;
} else {
target_efds = NULL;
efds_ptr = NULL;
}
if (target_tv) {
- target_to_host_timeval(&tv, target_tv);
+ if( copy_from_user_timeval(&tv, (struct target_timeval *)target_tv) ) return -EFAULT;
tv_ptr = &tv;
} else {
tv_ptr = NULL;
@@ -517,20 +515,14 @@
ok = !is_error(ret);
if (ok) {
- host_to_target_fds(target_rfds, rfds_ptr, n);
- host_to_target_fds(target_wfds, wfds_ptr, n);
- host_to_target_fds(target_efds, efds_ptr, n);
+ if( rfd_p && copy_to_user_fdset(rfd_p, &rfds, n) ) return -EFAULT;
+ if( wfd_p && copy_to_user_fdset(wfd_p, &wfds, n) ) return -EFAULT;
+ if( efd_p && copy_to_user_fdset(efd_p, &efds, n) ) return -EFAULT;
if (target_tv) {
- host_to_target_timeval(target_tv, &tv);
+ if( copy_to_user_timeval((struct target_timeval *)target_tv, &tv) ) return -EFAULT;
}
}
- if (target_rfds)
- unlock_user(target_rfds, rfd_p, ok ? sizeof(target_long) * n : 0);
- if (target_wfds)
- unlock_user(target_wfds, wfd_p, ok ? sizeof(target_long) * n : 0);
- if (target_efds)
- unlock_user(target_efds, efd_p, ok ? sizeof(target_long) * n : 0);
return ret;
}
@@ -2709,9 +2701,11 @@
{
struct timeval *tvp, tv[2];
if (arg2) {
- target_to_host_timeval(&tv[0], arg2);
- target_to_host_timeval(&tv[1],
- arg2 + sizeof (struct target_timeval));
+ if( copy_from_user_timeval(&tv[0], (struct target_timeval *)arg2) )
+ return -EFAULT;
+ if( copy_from_user_timeval(&tv[1],
+ (struct target_timeval *)(arg2 + sizeof (struct target_timeval))) )
+ return -EFAULT;
tvp = tv;
} else {
tvp = NULL;
@@ -3174,7 +3168,7 @@
struct rusage rusage;
ret = get_errno(getrusage(arg1, &rusage));
if (!is_error(ret)) {
- host_to_target_rusage(arg2, &rusage);
+ if( copy_to_user_rusage((struct target_rusage *)arg2, &rusage) ) return -EFAULT;
}
}
break;
@@ -3183,14 +3177,14 @@
struct timeval tv;
ret = get_errno(gettimeofday(&tv, NULL));
if (!is_error(ret)) {
- host_to_target_timeval(arg1, &tv);
+ copy_to_user_timeval(arg1, &tv);
}
}
break;
case TARGET_NR_settimeofday:
{
struct timeval tv;
- target_to_host_timeval(&tv, arg1);
+ copy_from_user_timeval(&tv, arg1);
ret = get_errno(settimeofday(&tv, NULL));
}
break;
@@ -3511,19 +3505,23 @@
if (arg2) {
pvalue = &value;
- target_to_host_timeval(&pvalue->it_interval,
- arg2);
- target_to_host_timeval(&pvalue->it_value,
- arg2 + sizeof(struct target_timeval));
+ if( copy_from_user_timeval(&pvalue->it_interval,
+ (struct target_timeval *)arg2) )
+ return -EFAULT;
+
+ if( copy_from_user_timeval(&pvalue->it_value,
+ (struct target_timeval *)(arg2 + sizeof(struct target_timeval))) )
+ return -EFAULT;
+
} else {
pvalue = NULL;
}
ret = get_errno(setitimer(arg1, pvalue, &ovalue));
if (!is_error(ret) && arg3) {
- host_to_target_timeval(arg3,
- &ovalue.it_interval);
- host_to_target_timeval(arg3 + sizeof(struct target_timeval),
- &ovalue.it_value);
+ if( copy_to_user_timeval((struct target_timeval *)arg3,
+ &ovalue.it_interval) ) return -EFAULT;
+ if( copy_to_user_timeval((struct target_timeval *)(arg3 + sizeof(struct target_timeval)),
+ &ovalue.it_value) ) return -EFAULT;
}
}
break;
@@ -3533,10 +3531,10 @@
ret = get_errno(getitimer(arg1, &value));
if (!is_error(ret) && arg2) {
- host_to_target_timeval(arg2,
- &value.it_interval);
- host_to_target_timeval(arg2 + sizeof(struct target_timeval),
- &value.it_value);
+ if( copy_to_user_timeval((struct target_timeval *)arg2,
+ &value.it_interval) ) return -EFAULT;
+ if( copy_to_user_timeval((struct target_timeval *)(arg2 + sizeof(struct target_timeval)),
+ &value.it_value) ) return -EFAULT;
}
}
break;
@@ -3633,7 +3631,8 @@
if (status_ptr)
tputl(status_ptr, status);
if (target_rusage) {
- host_to_target_rusage(target_rusage, &rusage);
+ if( copy_to_user_rusage(target_rusage, &rusage) )
+ return -EFAULT;
}
}
}
reply other threads:[~2007-09-19 1:10 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.64.0709182105040.20150@trantor.stuart.netsweng.com \
--to=anderson@netsweng.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).