* [Qemu-devel] RCF: [2/11] EFAULT patch
@ 2007-09-19 1:09 Stuart Anderson
0 siblings, 0 replies; only message in thread
From: Stuart Anderson @ 2007-09-19 1:09 UTC (permalink / raw)
To: qemu-devel
[-- Attachment #1: Type: TEXT/PLAIN, Size: 697 bytes --]
In this section, the functions for reading and writing fdsets, reading
rusage, and reading and writing timevals have been updated to use the
new kernel like interfaces.
Also, places where these function have been used are adjusted to match,
this includes do_select(), and the do_syscall() code for getrusage(),
gettimeofday(), settimeofday() and setitimer().
Stuart
Stuart R. Anderson anderson@netsweng.com
Network & Software Engineering http://www.netsweng.com/
1024D/37A79149: 0791 D3B8 9A4C 2CDC A31F
BD03 0A62 E534 37A7 9149
[-- Attachment #2: efault patch 2 of 11 --]
[-- Type: TEXT/PLAIN, Size: 12528 bytes --]
Index: qemu/linux-user/syscall.c
===================================================================
--- qemu.orig/linux-user/syscall.c 2007-09-17 16:17:38.000000000 -0400
+++ qemu/linux-user/syscall.c 2007-09-17 21:07:35.000000000 -0400
@@ -363,13 +363,15 @@
}
}
-static inline fd_set *target_to_host_fds(fd_set *fds,
+#define FD_MASK_SIZE (FD_SETSIZE/NFDBITS)
+
+static inline long copy_from_user_fdset(fd_set *fds,
target_long *target_fds, int n)
{
-#if !defined(BSWAP_NEEDED) && !defined(WORDS_BIGENDIAN)
- return (fd_set *)target_fds;
-#else
int i, b;
+
+ if( !access_ok(VERIFY_READ,target_fds,FD_MASK_SIZE) ) return -1;
+
if (target_fds) {
FD_ZERO(fds);
for(i = 0;i < n; i++) {
@@ -378,22 +380,18 @@
if (b)
FD_SET(i, fds);
}
- return fds;
- } else {
- return NULL;
}
-#endif
+ return 0;
}
-static inline void host_to_target_fds(target_long *target_fds,
+static inline long copy_to_user_fdset(target_long *target_fds,
fd_set *fds, int n)
{
-#if !defined(BSWAP_NEEDED) && !defined(WORDS_BIGENDIAN)
- /* nothing to do */
-#else
int i, nw, j, k;
target_long v;
+ if( !access_ok(VERIFY_WRITE,target_fds,FD_MASK_SIZE) ) return -1;
+
if (target_fds) {
nw = (n + TARGET_LONG_BITS - 1) / TARGET_LONG_BITS;
k = 0;
@@ -406,7 +404,7 @@
target_fds[i] = tswapl(v);
}
}
-#endif
+ return 0;
}
#if defined(__alpha__)
@@ -424,53 +422,50 @@
#endif
}
-static inline void host_to_target_rusage(target_ulong target_addr,
+static inline long copy_to_user_rusage(struct target_rusage *target_rusage,
const struct rusage *rusage)
{
- struct target_rusage *target_rusage;
+ if( !access_ok(VERIFY_WRITE,target_rusage,sizeof(*target_rusage)) ) return -1;
+ __put_user(rusage->ru_utime.tv_sec, &target_rusage->ru_utime.tv_sec);
+ __put_user(rusage->ru_utime.tv_usec, &target_rusage->ru_utime.tv_usec);
+ __put_user(rusage->ru_stime.tv_sec, &target_rusage->ru_stime.tv_sec);
+ __put_user(rusage->ru_stime.tv_usec, &target_rusage->ru_stime.tv_usec);
+ __put_user(rusage->ru_maxrss, &target_rusage->ru_maxrss);
+ __put_user(rusage->ru_ixrss, &target_rusage->ru_ixrss);
+ __put_user(rusage->ru_idrss, &target_rusage->ru_idrss);
+ __put_user(rusage->ru_isrss, &target_rusage->ru_isrss);
+ __put_user(rusage->ru_minflt, &target_rusage->ru_minflt);
+ __put_user(rusage->ru_majflt, &target_rusage->ru_majflt);
+ __put_user(rusage->ru_nswap, &target_rusage->ru_nswap);
+ __put_user(rusage->ru_inblock, &target_rusage->ru_inblock);
+ __put_user(rusage->ru_oublock, &target_rusage->ru_oublock);
+ __put_user(rusage->ru_msgsnd, &target_rusage->ru_msgsnd);
+ __put_user(rusage->ru_msgrcv, &target_rusage->ru_msgrcv);
+ __put_user(rusage->ru_nsignals, &target_rusage->ru_nsignals);
+ __put_user(rusage->ru_nvcsw, &target_rusage->ru_nvcsw);
+ __put_user(rusage->ru_nivcsw, &target_rusage->ru_nivcsw);
- lock_user_struct(target_rusage, target_addr, 0);
- target_rusage->ru_utime.tv_sec = tswapl(rusage->ru_utime.tv_sec);
- target_rusage->ru_utime.tv_usec = tswapl(rusage->ru_utime.tv_usec);
- target_rusage->ru_stime.tv_sec = tswapl(rusage->ru_stime.tv_sec);
- target_rusage->ru_stime.tv_usec = tswapl(rusage->ru_stime.tv_usec);
- target_rusage->ru_maxrss = tswapl(rusage->ru_maxrss);
- target_rusage->ru_ixrss = tswapl(rusage->ru_ixrss);
- target_rusage->ru_idrss = tswapl(rusage->ru_idrss);
- target_rusage->ru_isrss = tswapl(rusage->ru_isrss);
- target_rusage->ru_minflt = tswapl(rusage->ru_minflt);
- target_rusage->ru_majflt = tswapl(rusage->ru_majflt);
- target_rusage->ru_nswap = tswapl(rusage->ru_nswap);
- target_rusage->ru_inblock = tswapl(rusage->ru_inblock);
- target_rusage->ru_oublock = tswapl(rusage->ru_oublock);
- target_rusage->ru_msgsnd = tswapl(rusage->ru_msgsnd);
- target_rusage->ru_msgrcv = tswapl(rusage->ru_msgrcv);
- target_rusage->ru_nsignals = tswapl(rusage->ru_nsignals);
- target_rusage->ru_nvcsw = tswapl(rusage->ru_nvcsw);
- target_rusage->ru_nivcsw = tswapl(rusage->ru_nivcsw);
- unlock_user_struct(target_rusage, target_addr, 1);
+ return 0;
}
-static inline void target_to_host_timeval(struct timeval *tv,
- target_ulong target_addr)
+static inline long copy_from_user_timeval(struct timeval *tv,
+ struct target_timeval *target_tv)
{
- struct target_timeval *target_tv;
+ if( !access_ok(VERIFY_READ,target_tv,sizeof(*target_tv)) ) return -1;
+ __get_user(tv->tv_sec, &target_tv->tv_sec);
+ __get_user(tv->tv_usec, &target_tv->tv_usec);
- lock_user_struct(target_tv, target_addr, 1);
- tv->tv_sec = tswapl(target_tv->tv_sec);
- tv->tv_usec = tswapl(target_tv->tv_usec);
- unlock_user_struct(target_tv, target_addr, 0);
+ return 0;
}
-static inline void host_to_target_timeval(target_ulong target_addr,
+static inline long copy_to_user_timeval(struct target_timeval *target_tv,
const struct timeval *tv)
{
- struct target_timeval *target_tv;
+ if( !access_ok(VERIFY_WRITE,target_tv,sizeof(*target_tv)) ) return -1;
+ __put_user(tv->tv_sec, &target_tv->tv_sec);
+ __put_user(tv->tv_usec, &target_tv->tv_usec);
- lock_user_struct(target_tv, target_addr, 0);
- target_tv->tv_sec = tswapl(tv->tv_sec);
- target_tv->tv_usec = tswapl(tv->tv_usec);
- unlock_user_struct(target_tv, target_addr, 1);
+ return 0;
}
@@ -486,29 +481,32 @@
int ok;
if (rfd_p) {
- target_rfds = lock_user(rfd_p, sizeof(target_long) * n, 1);
- rfds_ptr = target_to_host_fds(&rfds, target_rfds, n);
+ if( copy_from_user_fdset(&rfds, rfd_p, n) ) return -EFAULT;
+ rfds_ptr = &rfds;
+ target_rfds = rfd_p;
} else {
target_rfds = NULL;
rfds_ptr = NULL;
}
if (wfd_p) {
- target_wfds = lock_user(wfd_p, sizeof(target_long) * n, 1);
- wfds_ptr = target_to_host_fds(&wfds, target_wfds, n);
+ if( copy_from_user_fdset(&wfds, wfd_p, n) ) return -EFAULT;
+ wfds_ptr = &wfds;
+ target_wfds = wfd_p;
} else {
target_wfds = NULL;
wfds_ptr = NULL;
}
if (efd_p) {
- target_efds = lock_user(efd_p, sizeof(target_long) * n, 1);
- efds_ptr = target_to_host_fds(&efds, target_efds, n);
+ if( copy_from_user_fdset(&efds, efd_p, n) ) return -EFAULT;
+ efds_ptr = &efds;
+ target_efds = efd_p;
} else {
target_efds = NULL;
efds_ptr = NULL;
}
if (target_tv) {
- target_to_host_timeval(&tv, target_tv);
+ if( copy_from_user_timeval(&tv, (struct target_timeval *)target_tv) ) return -EFAULT;
tv_ptr = &tv;
} else {
tv_ptr = NULL;
@@ -517,20 +515,14 @@
ok = !is_error(ret);
if (ok) {
- host_to_target_fds(target_rfds, rfds_ptr, n);
- host_to_target_fds(target_wfds, wfds_ptr, n);
- host_to_target_fds(target_efds, efds_ptr, n);
+ if( rfd_p && copy_to_user_fdset(rfd_p, &rfds, n) ) return -EFAULT;
+ if( wfd_p && copy_to_user_fdset(wfd_p, &wfds, n) ) return -EFAULT;
+ if( efd_p && copy_to_user_fdset(efd_p, &efds, n) ) return -EFAULT;
if (target_tv) {
- host_to_target_timeval(target_tv, &tv);
+ if( copy_to_user_timeval((struct target_timeval *)target_tv, &tv) ) return -EFAULT;
}
}
- if (target_rfds)
- unlock_user(target_rfds, rfd_p, ok ? sizeof(target_long) * n : 0);
- if (target_wfds)
- unlock_user(target_wfds, wfd_p, ok ? sizeof(target_long) * n : 0);
- if (target_efds)
- unlock_user(target_efds, efd_p, ok ? sizeof(target_long) * n : 0);
return ret;
}
@@ -2709,9 +2701,11 @@
{
struct timeval *tvp, tv[2];
if (arg2) {
- target_to_host_timeval(&tv[0], arg2);
- target_to_host_timeval(&tv[1],
- arg2 + sizeof (struct target_timeval));
+ if( copy_from_user_timeval(&tv[0], (struct target_timeval *)arg2) )
+ return -EFAULT;
+ if( copy_from_user_timeval(&tv[1],
+ (struct target_timeval *)(arg2 + sizeof (struct target_timeval))) )
+ return -EFAULT;
tvp = tv;
} else {
tvp = NULL;
@@ -3174,7 +3168,7 @@
struct rusage rusage;
ret = get_errno(getrusage(arg1, &rusage));
if (!is_error(ret)) {
- host_to_target_rusage(arg2, &rusage);
+ if( copy_to_user_rusage((struct target_rusage *)arg2, &rusage) ) return -EFAULT;
}
}
break;
@@ -3183,14 +3177,14 @@
struct timeval tv;
ret = get_errno(gettimeofday(&tv, NULL));
if (!is_error(ret)) {
- host_to_target_timeval(arg1, &tv);
+ copy_to_user_timeval(arg1, &tv);
}
}
break;
case TARGET_NR_settimeofday:
{
struct timeval tv;
- target_to_host_timeval(&tv, arg1);
+ copy_from_user_timeval(&tv, arg1);
ret = get_errno(settimeofday(&tv, NULL));
}
break;
@@ -3511,19 +3505,23 @@
if (arg2) {
pvalue = &value;
- target_to_host_timeval(&pvalue->it_interval,
- arg2);
- target_to_host_timeval(&pvalue->it_value,
- arg2 + sizeof(struct target_timeval));
+ if( copy_from_user_timeval(&pvalue->it_interval,
+ (struct target_timeval *)arg2) )
+ return -EFAULT;
+
+ if( copy_from_user_timeval(&pvalue->it_value,
+ (struct target_timeval *)(arg2 + sizeof(struct target_timeval))) )
+ return -EFAULT;
+
} else {
pvalue = NULL;
}
ret = get_errno(setitimer(arg1, pvalue, &ovalue));
if (!is_error(ret) && arg3) {
- host_to_target_timeval(arg3,
- &ovalue.it_interval);
- host_to_target_timeval(arg3 + sizeof(struct target_timeval),
- &ovalue.it_value);
+ if( copy_to_user_timeval((struct target_timeval *)arg3,
+ &ovalue.it_interval) ) return -EFAULT;
+ if( copy_to_user_timeval((struct target_timeval *)(arg3 + sizeof(struct target_timeval)),
+ &ovalue.it_value) ) return -EFAULT;
}
}
break;
@@ -3533,10 +3531,10 @@
ret = get_errno(getitimer(arg1, &value));
if (!is_error(ret) && arg2) {
- host_to_target_timeval(arg2,
- &value.it_interval);
- host_to_target_timeval(arg2 + sizeof(struct target_timeval),
- &value.it_value);
+ if( copy_to_user_timeval((struct target_timeval *)arg2,
+ &value.it_interval) ) return -EFAULT;
+ if( copy_to_user_timeval((struct target_timeval *)(arg2 + sizeof(struct target_timeval)),
+ &value.it_value) ) return -EFAULT;
}
}
break;
@@ -3633,7 +3631,8 @@
if (status_ptr)
tputl(status_ptr, status);
if (target_rusage) {
- host_to_target_rusage(target_rusage, &rusage);
+ if( copy_to_user_rusage(target_rusage, &rusage) )
+ return -EFAULT;
}
}
}
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2007-09-19 1:10 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-09-19 1:09 [Qemu-devel] RCF: [2/11] EFAULT patch Stuart Anderson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).