qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Stuart Anderson <anderson@netsweng.com>
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] RFC: [4/11] EFAULT patch
Date: Tue, 18 Sep 2007 21:18:03 -0400 (EDT)	[thread overview]
Message-ID: <Pine.LNX.4.64.0709182115330.20150@trantor.stuart.netsweng.com> (raw)

[-- Attachment #1: Type: TEXT/PLAIN, Size: 515 bytes --]


This part contains the updates for the semaphore IPC syscalls. In
addition to the changes to use the new APIs, there are also fixes for
some of the semop() and semctl() actions.


                                 Stuart

Stuart R. Anderson                               anderson@netsweng.com
Network & Software Engineering                   http://www.netsweng.com/
1024D/37A79149:                                  0791 D3B8 9A4C 2CDC A31F
                                                  BD03 0A62 E534 37A7 9149

[-- Attachment #2: efault patch 4 of 11 --]
[-- Type: TEXT/PLAIN, Size: 11716 bytes --]

Index: qemu/linux-user/syscall.c
===================================================================
--- qemu.orig/linux-user/syscall.c	2007-09-16 15:56:36.000000000 -0400
+++ qemu/linux-user/syscall.c	2007-09-16 15:56:37.000000000 -0400
@@ -1289,64 +1289,50 @@
   target_ulong __unused4;
 };
 
-static inline void target_to_host_ipc_perm(struct ipc_perm *host_ip,
-                                           target_ulong target_addr)
+static inline void copy_from_user_ipc_perm(struct ipc_perm *host_ip,
+                                           struct target_ipc_perm *target_ip)
 {
-    struct target_ipc_perm *target_ip;
-    struct target_semid_ds *target_sd;
-
-    lock_user_struct(target_sd, target_addr, 1);
-    target_ip=&(target_sd->sem_perm);
-    host_ip->__key = tswapl(target_ip->__key);
-    host_ip->uid = tswapl(target_ip->uid);
-    host_ip->gid = tswapl(target_ip->gid);
-    host_ip->cuid = tswapl(target_ip->cuid);
-    host_ip->cgid = tswapl(target_ip->cgid);
-    host_ip->mode = tswapl(target_ip->mode);
-    unlock_user_struct(target_sd, target_addr, 0);
+    /* access has already been checked */
+    __get_user(host_ip->__key, &target_ip->__key);
+    __get_user(host_ip->uid, &target_ip->uid);
+    __get_user(host_ip->gid, &target_ip->gid);
+    __get_user(host_ip->cuid, &target_ip->cuid);
+    __get_user(host_ip->cgid, &target_ip->cgid);
+    __get_user(host_ip->mode, &target_ip->mode);
+    __get_user(host_ip->__seq, &target_ip->__seq);
 }
 
-static inline void host_to_target_ipc_perm(target_ulong target_addr,
+static inline void copy_to_user_ipc_perm(struct target_ipc_perm *target_ip,
                                            struct ipc_perm *host_ip)
 {
-    struct target_ipc_perm *target_ip;
-    struct target_semid_ds *target_sd;
-
-    lock_user_struct(target_sd, target_addr, 0);
-    target_ip = &(target_sd->sem_perm);
-    target_ip->__key = tswapl(host_ip->__key);
-    target_ip->uid = tswapl(host_ip->uid);
-    target_ip->gid = tswapl(host_ip->gid);
-    target_ip->cuid = tswapl(host_ip->cuid);
-    target_ip->cgid = tswapl(host_ip->cgid);
-    target_ip->mode = tswapl(host_ip->mode);
-    unlock_user_struct(target_sd, target_addr, 1);
-}
-
-static inline void target_to_host_semid_ds(struct semid_ds *host_sd,
-                                          target_ulong target_addr)
-{
-    struct target_semid_ds *target_sd;
-
-    lock_user_struct(target_sd, target_addr, 1);
-    target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr);
-    host_sd->sem_nsems = tswapl(target_sd->sem_nsems);
-    host_sd->sem_otime = tswapl(target_sd->sem_otime);
-    host_sd->sem_ctime = tswapl(target_sd->sem_ctime);
-    unlock_user_struct(target_sd, target_addr, 0);
+    /* access has already been checked */
+    __put_user(host_ip->__key, &target_ip->__key);
+    __put_user(host_ip->uid, &target_ip->uid);
+    __put_user(host_ip->gid, &target_ip->gid);
+    __put_user(host_ip->cuid, &target_ip->cuid);
+    __put_user(host_ip->cgid, &target_ip->cgid);
+    __put_user(host_ip->mode, &target_ip->mode);
+    __put_user(host_ip->__seq, &target_ip->__seq);
+}
+
+static inline void copy_from_user_semid_ds(struct semid_ds *host_sd,
+                                          struct target_semid_ds *target_sd)
+{
+    /* access has already been checked */
+    copy_from_user_ipc_perm(&(host_sd->sem_perm),&(target_sd->sem_perm));
+    __get_user(host_sd->sem_nsems, &target_sd->sem_nsems);
+    __get_user(host_sd->sem_otime, &target_sd->sem_otime);
+    __get_user(host_sd->sem_ctime, &target_sd->sem_ctime);
 }
 
-static inline void host_to_target_semid_ds(target_ulong target_addr,
+static inline void copy_to_user_semid_ds(struct target_semid_ds *target_sd,
                                            struct semid_ds *host_sd)
 {
-    struct target_semid_ds *target_sd;
-
-    lock_user_struct(target_sd, target_addr, 0);
-    host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm));
-    target_sd->sem_nsems = tswapl(host_sd->sem_nsems);
-    target_sd->sem_otime = tswapl(host_sd->sem_otime);
-    target_sd->sem_ctime = tswapl(host_sd->sem_ctime);
-    unlock_user_struct(target_sd, target_addr, 1);
+    /* access has already been checked */
+    copy_to_user_ipc_perm(&(target_sd->sem_perm),&(host_sd->sem_perm));
+    __put_user(host_sd->sem_nsems, &target_sd->sem_nsems);
+    __put_user(host_sd->sem_otime, &target_sd->sem_otime);
+    __put_user(host_sd->sem_ctime, &target_sd->sem_ctime);
 }
 
 union semun {
@@ -1357,113 +1343,108 @@
 
 union target_semun {
 	int val;
-	target_long buf;
-	unsigned short int *array;
+	struct target_semid_ds *buf;
+	unsigned short *array;
+	long host_ptr;
 };
 
-static inline void target_to_host_semun(unsigned long cmd,
-                                        union semun *host_su,
-                                        target_ulong target_addr,
+static inline long copy_from_user_semun(unsigned long cmd,
+                                        union semun host_su,
+                                        union target_semun target_su,
                                         struct semid_ds *ds)
 {
-    union target_semun *target_su;
-
     switch( cmd ) {
-	case IPC_STAT:
 	case IPC_SET:
-           lock_user_struct(target_su, target_addr, 1);
-	   target_to_host_semid_ds(ds,target_su->buf);
-	   host_su->buf = ds;
-           unlock_user_struct(target_su, target_addr, 0);
+	   if( !access_ok(VERIFY_READ,(target_ulong)target_su.buf,sizeof(struct target_semid_ds)) ) return -1;
+	   copy_from_user_semid_ds(ds,target_su.buf);
+	   host_su.buf = ds;
 	   break;
-	case GETVAL:
-	case SETVAL:
-           lock_user_struct(target_su, target_addr, 1);
-	   host_su->val = tswapl(target_su->val);
-           unlock_user_struct(target_su, target_addr, 0);
-	   break;
-	case GETALL:
 	case SETALL:
-           lock_user_struct(target_su, target_addr, 1);
-	   *host_su->array = tswap16(*target_su->array);
-           unlock_user_struct(target_su, target_addr, 0);
+           {
+           int i;
+           for(i=0;i<ds->sem_nsems;i++)
+	       if (get_user(host_su.array[i],&(target_su.array[i]))) return -1;
 	   break;
+           }
 	default:
            gemu_log("semun operation not fully supported: %d\n", (int)cmd);
     }
+
+    return 0;
 }
 
-static inline void host_to_target_semun(unsigned long cmd,
-                                        target_ulong target_addr,
-                                        union semun *host_su,
+static inline long copy_to_user_semun(unsigned long cmd,
+                                        union target_semun target_su,
+                                        union semun host_su,
                                         struct semid_ds *ds)
 {
-    union target_semun *target_su;
-
     switch( cmd ) {
 	case IPC_STAT:
-	case IPC_SET:
-           lock_user_struct(target_su, target_addr, 0);
-	   host_to_target_semid_ds(target_su->buf,ds);
-           unlock_user_struct(target_su, target_addr, 1);
-	   break;
-	case GETVAL:
-	case SETVAL:
-           lock_user_struct(target_su, target_addr, 0);
-	   target_su->val = tswapl(host_su->val);
-           unlock_user_struct(target_su, target_addr, 1);
+	   if( !access_ok(VERIFY_WRITE,(target_ulong)target_su.buf,sizeof(struct target_semid_ds)) ) return -1;
+	   copy_to_user_semid_ds(target_su.buf,ds);
 	   break;
 	case GETALL:
-	case SETALL:
-           lock_user_struct(target_su, target_addr, 0);
-	   *target_su->array = tswap16(*host_su->array);
-           unlock_user_struct(target_su, target_addr, 1);
+           {
+           int i;
+           for(i=0;i<ds->sem_nsems;i++)
+	       if (put_user(host_su.array[i],&(target_su.array[i]))) return -1;
 	   break;
+           }
         default:
            gemu_log("semun operation not fully supported: %d\n", (int)cmd);
     }
+
+    return 0;
 }
 
 static inline long do_semctl(long first, long second, long third, long ptr)
 {
     union semun arg;
+    union target_semun targ = (union target_semun)ptr;
     struct semid_ds dsarg;
     int cmd = third&0xff;
     long ret = 0;
 
+    arg.buf = &dsarg;
+
     switch( cmd ) {
 	case GETVAL:
-            target_to_host_semun(cmd,&arg,ptr,&dsarg);
-            ret = get_errno(semctl(first, second, cmd, arg));
-            host_to_target_semun(cmd,ptr,&arg,&dsarg);
+            ret = get_errno(semctl(first, second, cmd, targ));
             break;
 	case SETVAL:
-            target_to_host_semun(cmd,&arg,ptr,&dsarg);
-            ret = get_errno(semctl(first, second, cmd, arg));
-            host_to_target_semun(cmd,ptr,&arg,&dsarg);
+            ret = get_errno(semctl(first, second, cmd, targ.val));
             break;
 	case GETALL:
-            target_to_host_semun(cmd,&arg,ptr,&dsarg);
+		/* Use IPC_STAT to figure out how many semaphores are in
+		 * the set, and allocate buffer space for them.
+		 */
+            semctl(first,second, IPC_STAT,arg);
+            arg.array = alloca(sizeof(unsigned short)*dsarg.sem_nsems);
             ret = get_errno(semctl(first, second, cmd, arg));
-            host_to_target_semun(cmd,ptr,&arg,&dsarg);
+    	    if (!is_error(ret)) {
+                if( copy_to_user_semun(cmd,targ,arg,&dsarg) ) return -EFAULT;
+	    }
             break;
 	case SETALL:
-            target_to_host_semun(cmd,&arg,ptr,&dsarg);
+		/* Use IPC_STAT to figure out how many semaphores are in
+		 * the set, and allocate buffer space for them.
+		 */
+            semctl(first,second, IPC_STAT,arg);
+            arg.array = alloca(sizeof(unsigned short)*dsarg.sem_nsems);
+            if( copy_from_user_semun(cmd,arg,targ,&dsarg) ) return -EFAULT;
             ret = get_errno(semctl(first, second, cmd, arg));
-            host_to_target_semun(cmd,ptr,&arg,&dsarg);
             break;
 	case IPC_STAT:
-            target_to_host_semun(cmd,&arg,ptr,&dsarg);
             ret = get_errno(semctl(first, second, cmd, arg));
-            host_to_target_semun(cmd,ptr,&arg,&dsarg);
+            if( copy_to_user_semun(cmd,targ,arg,&dsarg) ) return -EFAULT;
             break;
 	case IPC_SET:
-            target_to_host_semun(cmd,&arg,ptr,&dsarg);
+            if( copy_from_user(arg.buf,targ.buf,sizeof(union target_semun)) ) return -EFAULT;
+            if( copy_from_user_semun(cmd,arg,targ,&dsarg) ) return -EFAULT;
             ret = get_errno(semctl(first, second, cmd, arg));
-            host_to_target_semun(cmd,ptr,&arg,&dsarg);
             break;
     default:
-            ret = get_errno(semctl(first, second, cmd, arg));
+            ret = get_errno(semctl(first, second, cmd, ptr));
     }
 
     return ret;
@@ -1493,7 +1474,7 @@
     struct target_msqid_ds *target_md;
 
     lock_user_struct(target_md, target_addr, 1);
-    target_to_host_ipc_perm(&(host_md->msg_perm),target_addr);
+    copy_from_user_ipc_perm(&(host_md->msg_perm),target_addr);
     host_md->msg_stime = tswapl(target_md->msg_stime);
     host_md->msg_rtime = tswapl(target_md->msg_rtime);
     host_md->msg_ctime = tswapl(target_md->msg_ctime);
@@ -1511,7 +1492,7 @@
     struct target_msqid_ds *target_md;
 
     lock_user_struct(target_md, target_addr, 0);
-    host_to_target_ipc_perm(target_addr,&(host_md->msg_perm));
+    copy_to_user_ipc_perm(target_addr,&(host_md->msg_perm));
     target_md->msg_stime = tswapl(host_md->msg_stime);
     target_md->msg_rtime = tswapl(host_md->msg_rtime);
     target_md->msg_ctime = tswapl(host_md->msg_ctime);

                 reply	other threads:[~2007-09-19  1:20 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Pine.LNX.4.64.0709182115330.20150@trantor.stuart.netsweng.com \
    --to=anderson@netsweng.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).