* [Qemu-devel] RFC: [4/11] EFAULT patch
@ 2007-09-19 1:18 Stuart Anderson
0 siblings, 0 replies; only message in thread
From: Stuart Anderson @ 2007-09-19 1:18 UTC (permalink / raw)
To: qemu-devel
[-- Attachment #1: Type: TEXT/PLAIN, Size: 515 bytes --]
This part contains the updates for the semaphore IPC syscalls. In
addition to the changes to use the new APIs, there are also fixes for
some of the semop() and semctl() actions.
Stuart
Stuart R. Anderson anderson@netsweng.com
Network & Software Engineering http://www.netsweng.com/
1024D/37A79149: 0791 D3B8 9A4C 2CDC A31F
BD03 0A62 E534 37A7 9149
[-- Attachment #2: efault patch 4 of 11 --]
[-- Type: TEXT/PLAIN, Size: 11716 bytes --]
Index: qemu/linux-user/syscall.c
===================================================================
--- qemu.orig/linux-user/syscall.c 2007-09-16 15:56:36.000000000 -0400
+++ qemu/linux-user/syscall.c 2007-09-16 15:56:37.000000000 -0400
@@ -1289,64 +1289,50 @@
target_ulong __unused4;
};
-static inline void target_to_host_ipc_perm(struct ipc_perm *host_ip,
- target_ulong target_addr)
+static inline void copy_from_user_ipc_perm(struct ipc_perm *host_ip,
+ struct target_ipc_perm *target_ip)
{
- struct target_ipc_perm *target_ip;
- struct target_semid_ds *target_sd;
-
- lock_user_struct(target_sd, target_addr, 1);
- target_ip=&(target_sd->sem_perm);
- host_ip->__key = tswapl(target_ip->__key);
- host_ip->uid = tswapl(target_ip->uid);
- host_ip->gid = tswapl(target_ip->gid);
- host_ip->cuid = tswapl(target_ip->cuid);
- host_ip->cgid = tswapl(target_ip->cgid);
- host_ip->mode = tswapl(target_ip->mode);
- unlock_user_struct(target_sd, target_addr, 0);
+ /* access has already been checked */
+ __get_user(host_ip->__key, &target_ip->__key);
+ __get_user(host_ip->uid, &target_ip->uid);
+ __get_user(host_ip->gid, &target_ip->gid);
+ __get_user(host_ip->cuid, &target_ip->cuid);
+ __get_user(host_ip->cgid, &target_ip->cgid);
+ __get_user(host_ip->mode, &target_ip->mode);
+ __get_user(host_ip->__seq, &target_ip->__seq);
}
-static inline void host_to_target_ipc_perm(target_ulong target_addr,
+static inline void copy_to_user_ipc_perm(struct target_ipc_perm *target_ip,
struct ipc_perm *host_ip)
{
- struct target_ipc_perm *target_ip;
- struct target_semid_ds *target_sd;
-
- lock_user_struct(target_sd, target_addr, 0);
- target_ip = &(target_sd->sem_perm);
- target_ip->__key = tswapl(host_ip->__key);
- target_ip->uid = tswapl(host_ip->uid);
- target_ip->gid = tswapl(host_ip->gid);
- target_ip->cuid = tswapl(host_ip->cuid);
- target_ip->cgid = tswapl(host_ip->cgid);
- target_ip->mode = tswapl(host_ip->mode);
- unlock_user_struct(target_sd, target_addr, 1);
-}
-
-static inline void target_to_host_semid_ds(struct semid_ds *host_sd,
- target_ulong target_addr)
-{
- struct target_semid_ds *target_sd;
-
- lock_user_struct(target_sd, target_addr, 1);
- target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr);
- host_sd->sem_nsems = tswapl(target_sd->sem_nsems);
- host_sd->sem_otime = tswapl(target_sd->sem_otime);
- host_sd->sem_ctime = tswapl(target_sd->sem_ctime);
- unlock_user_struct(target_sd, target_addr, 0);
+ /* access has already been checked */
+ __put_user(host_ip->__key, &target_ip->__key);
+ __put_user(host_ip->uid, &target_ip->uid);
+ __put_user(host_ip->gid, &target_ip->gid);
+ __put_user(host_ip->cuid, &target_ip->cuid);
+ __put_user(host_ip->cgid, &target_ip->cgid);
+ __put_user(host_ip->mode, &target_ip->mode);
+ __put_user(host_ip->__seq, &target_ip->__seq);
+}
+
+static inline void copy_from_user_semid_ds(struct semid_ds *host_sd,
+ struct target_semid_ds *target_sd)
+{
+ /* access has already been checked */
+ copy_from_user_ipc_perm(&(host_sd->sem_perm),&(target_sd->sem_perm));
+ __get_user(host_sd->sem_nsems, &target_sd->sem_nsems);
+ __get_user(host_sd->sem_otime, &target_sd->sem_otime);
+ __get_user(host_sd->sem_ctime, &target_sd->sem_ctime);
}
-static inline void host_to_target_semid_ds(target_ulong target_addr,
+static inline void copy_to_user_semid_ds(struct target_semid_ds *target_sd,
struct semid_ds *host_sd)
{
- struct target_semid_ds *target_sd;
-
- lock_user_struct(target_sd, target_addr, 0);
- host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm));
- target_sd->sem_nsems = tswapl(host_sd->sem_nsems);
- target_sd->sem_otime = tswapl(host_sd->sem_otime);
- target_sd->sem_ctime = tswapl(host_sd->sem_ctime);
- unlock_user_struct(target_sd, target_addr, 1);
+ /* access has already been checked */
+ copy_to_user_ipc_perm(&(target_sd->sem_perm),&(host_sd->sem_perm));
+ __put_user(host_sd->sem_nsems, &target_sd->sem_nsems);
+ __put_user(host_sd->sem_otime, &target_sd->sem_otime);
+ __put_user(host_sd->sem_ctime, &target_sd->sem_ctime);
}
union semun {
@@ -1357,113 +1343,108 @@
union target_semun {
int val;
- target_long buf;
- unsigned short int *array;
+ struct target_semid_ds *buf;
+ unsigned short *array;
+ long host_ptr;
};
-static inline void target_to_host_semun(unsigned long cmd,
- union semun *host_su,
- target_ulong target_addr,
+static inline long copy_from_user_semun(unsigned long cmd,
+ union semun host_su,
+ union target_semun target_su,
struct semid_ds *ds)
{
- union target_semun *target_su;
-
switch( cmd ) {
- case IPC_STAT:
case IPC_SET:
- lock_user_struct(target_su, target_addr, 1);
- target_to_host_semid_ds(ds,target_su->buf);
- host_su->buf = ds;
- unlock_user_struct(target_su, target_addr, 0);
+ if( !access_ok(VERIFY_READ,(target_ulong)target_su.buf,sizeof(struct target_semid_ds)) ) return -1;
+ copy_from_user_semid_ds(ds,target_su.buf);
+ host_su.buf = ds;
break;
- case GETVAL:
- case SETVAL:
- lock_user_struct(target_su, target_addr, 1);
- host_su->val = tswapl(target_su->val);
- unlock_user_struct(target_su, target_addr, 0);
- break;
- case GETALL:
case SETALL:
- lock_user_struct(target_su, target_addr, 1);
- *host_su->array = tswap16(*target_su->array);
- unlock_user_struct(target_su, target_addr, 0);
+ {
+ int i;
+ for(i=0;i<ds->sem_nsems;i++)
+ if (get_user(host_su.array[i],&(target_su.array[i]))) return -1;
break;
+ }
default:
gemu_log("semun operation not fully supported: %d\n", (int)cmd);
}
+
+ return 0;
}
-static inline void host_to_target_semun(unsigned long cmd,
- target_ulong target_addr,
- union semun *host_su,
+static inline long copy_to_user_semun(unsigned long cmd,
+ union target_semun target_su,
+ union semun host_su,
struct semid_ds *ds)
{
- union target_semun *target_su;
-
switch( cmd ) {
case IPC_STAT:
- case IPC_SET:
- lock_user_struct(target_su, target_addr, 0);
- host_to_target_semid_ds(target_su->buf,ds);
- unlock_user_struct(target_su, target_addr, 1);
- break;
- case GETVAL:
- case SETVAL:
- lock_user_struct(target_su, target_addr, 0);
- target_su->val = tswapl(host_su->val);
- unlock_user_struct(target_su, target_addr, 1);
+ if( !access_ok(VERIFY_WRITE,(target_ulong)target_su.buf,sizeof(struct target_semid_ds)) ) return -1;
+ copy_to_user_semid_ds(target_su.buf,ds);
break;
case GETALL:
- case SETALL:
- lock_user_struct(target_su, target_addr, 0);
- *target_su->array = tswap16(*host_su->array);
- unlock_user_struct(target_su, target_addr, 1);
+ {
+ int i;
+ for(i=0;i<ds->sem_nsems;i++)
+ if (put_user(host_su.array[i],&(target_su.array[i]))) return -1;
break;
+ }
default:
gemu_log("semun operation not fully supported: %d\n", (int)cmd);
}
+
+ return 0;
}
static inline long do_semctl(long first, long second, long third, long ptr)
{
union semun arg;
+ union target_semun targ = (union target_semun)ptr;
struct semid_ds dsarg;
int cmd = third&0xff;
long ret = 0;
+ arg.buf = &dsarg;
+
switch( cmd ) {
case GETVAL:
- target_to_host_semun(cmd,&arg,ptr,&dsarg);
- ret = get_errno(semctl(first, second, cmd, arg));
- host_to_target_semun(cmd,ptr,&arg,&dsarg);
+ ret = get_errno(semctl(first, second, cmd, targ));
break;
case SETVAL:
- target_to_host_semun(cmd,&arg,ptr,&dsarg);
- ret = get_errno(semctl(first, second, cmd, arg));
- host_to_target_semun(cmd,ptr,&arg,&dsarg);
+ ret = get_errno(semctl(first, second, cmd, targ.val));
break;
case GETALL:
- target_to_host_semun(cmd,&arg,ptr,&dsarg);
+ /* Use IPC_STAT to figure out how many semaphores are in
+ * the set, and allocate buffer space for them.
+ */
+ semctl(first,second, IPC_STAT,arg);
+ arg.array = alloca(sizeof(unsigned short)*dsarg.sem_nsems);
ret = get_errno(semctl(first, second, cmd, arg));
- host_to_target_semun(cmd,ptr,&arg,&dsarg);
+ if (!is_error(ret)) {
+ if( copy_to_user_semun(cmd,targ,arg,&dsarg) ) return -EFAULT;
+ }
break;
case SETALL:
- target_to_host_semun(cmd,&arg,ptr,&dsarg);
+ /* Use IPC_STAT to figure out how many semaphores are in
+ * the set, and allocate buffer space for them.
+ */
+ semctl(first,second, IPC_STAT,arg);
+ arg.array = alloca(sizeof(unsigned short)*dsarg.sem_nsems);
+ if( copy_from_user_semun(cmd,arg,targ,&dsarg) ) return -EFAULT;
ret = get_errno(semctl(first, second, cmd, arg));
- host_to_target_semun(cmd,ptr,&arg,&dsarg);
break;
case IPC_STAT:
- target_to_host_semun(cmd,&arg,ptr,&dsarg);
ret = get_errno(semctl(first, second, cmd, arg));
- host_to_target_semun(cmd,ptr,&arg,&dsarg);
+ if( copy_to_user_semun(cmd,targ,arg,&dsarg) ) return -EFAULT;
break;
case IPC_SET:
- target_to_host_semun(cmd,&arg,ptr,&dsarg);
+ if( copy_from_user(arg.buf,targ.buf,sizeof(union target_semun)) ) return -EFAULT;
+ if( copy_from_user_semun(cmd,arg,targ,&dsarg) ) return -EFAULT;
ret = get_errno(semctl(first, second, cmd, arg));
- host_to_target_semun(cmd,ptr,&arg,&dsarg);
break;
default:
- ret = get_errno(semctl(first, second, cmd, arg));
+ ret = get_errno(semctl(first, second, cmd, ptr));
}
return ret;
@@ -1493,7 +1474,7 @@
struct target_msqid_ds *target_md;
lock_user_struct(target_md, target_addr, 1);
- target_to_host_ipc_perm(&(host_md->msg_perm),target_addr);
+ copy_from_user_ipc_perm(&(host_md->msg_perm),target_addr);
host_md->msg_stime = tswapl(target_md->msg_stime);
host_md->msg_rtime = tswapl(target_md->msg_rtime);
host_md->msg_ctime = tswapl(target_md->msg_ctime);
@@ -1511,7 +1492,7 @@
struct target_msqid_ds *target_md;
lock_user_struct(target_md, target_addr, 0);
- host_to_target_ipc_perm(target_addr,&(host_md->msg_perm));
+ copy_to_user_ipc_perm(target_addr,&(host_md->msg_perm));
target_md->msg_stime = tswapl(host_md->msg_stime);
target_md->msg_rtime = tswapl(host_md->msg_rtime);
target_md->msg_ctime = tswapl(host_md->msg_ctime);
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2007-09-19 1:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-09-19 1:18 [Qemu-devel] RFC: [4/11] EFAULT patch Stuart Anderson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).