* [PATCH] linux-user: Prevent crash in epoll_ctl
@ 2020-04-17 15:34 LemonBoy
2020-11-10 17:03 ` Laurent Vivier
2020-11-11 21:37 ` Laurent Vivier
0 siblings, 2 replies; 3+ messages in thread
From: LemonBoy @ 2020-04-17 15:34 UTC (permalink / raw)
To: qemu-devel, Laurent Vivier
From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
From: Giuseppe Musacchio <thatlemon@gmail.com>
Date: Fri, 17 Apr 2020 17:25:07 +0200
Subject: [PATCH] linux-user: Prevent crash in epoll_ctl
The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
do the same and avoid returning EFAULT if garbage is passed instead of a
valid pointer.
Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
---
linux-user/syscall.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 674f70e70a..a51ff43f9b 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
struct epoll_event ep;
struct epoll_event *epp = 0;
if (arg4) {
- struct target_epoll_event *target_ep;
- if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
- return -TARGET_EFAULT;
+ if (arg2 != EPOLL_CTL_DEL) {
+ struct target_epoll_event *target_ep;
+ if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
+ return -TARGET_EFAULT;
+ }
+ ep.events = tswap32(target_ep->events);
+ /*
+ * The epoll_data_t union is just opaque data to the kernel,
+ * so we transfer all 64 bits across and need not worry what
+ * actual data type it is.
+ */
+ ep.data.u64 = tswap64(target_ep->data.u64);
+ unlock_user_struct(target_ep, arg4, 0);
}
- ep.events = tswap32(target_ep->events);
- /* The epoll_data_t union is just opaque data to the kernel,
- * so we transfer all 64 bits across and need not worry what
- * actual data type it is.
+ /*
+ * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
+ * non-null pointer, even though this argument is ignored.
+ *
*/
- ep.data.u64 = tswap64(target_ep->data.u64);
- unlock_user_struct(target_ep, arg4, 0);
epp = &ep;
}
return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
--
2.20.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] linux-user: Prevent crash in epoll_ctl
2020-04-17 15:34 [PATCH] linux-user: Prevent crash in epoll_ctl LemonBoy
@ 2020-11-10 17:03 ` Laurent Vivier
2020-11-11 21:37 ` Laurent Vivier
1 sibling, 0 replies; 3+ messages in thread
From: Laurent Vivier @ 2020-11-10 17:03 UTC (permalink / raw)
To: LemonBoy, qemu-devel
Le 17/04/2020 à 17:34, LemonBoy a écrit :
> From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
> From: Giuseppe Musacchio <thatlemon@gmail.com>
> Date: Fri, 17 Apr 2020 17:25:07 +0200
> Subject: [PATCH] linux-user: Prevent crash in epoll_ctl
>
> The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
> do the same and avoid returning EFAULT if garbage is passed instead of a
> valid pointer.
>
> Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
> ---
> linux-user/syscall.c | 26 +++++++++++++++++---------
> 1 file changed, 17 insertions(+), 9 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 674f70e70a..a51ff43f9b 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
> struct epoll_event ep;
> struct epoll_event *epp = 0;
> if (arg4) {
> - struct target_epoll_event *target_ep;
> - if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> - return -TARGET_EFAULT;
> + if (arg2 != EPOLL_CTL_DEL) {
> + struct target_epoll_event *target_ep;
> + if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> + return -TARGET_EFAULT;
> + }
> + ep.events = tswap32(target_ep->events);
> + /*
> + * The epoll_data_t union is just opaque data to the kernel,
> + * so we transfer all 64 bits across and need not worry what
> + * actual data type it is.
> + */
> + ep.data.u64 = tswap64(target_ep->data.u64);
> + unlock_user_struct(target_ep, arg4, 0);
> }
> - ep.events = tswap32(target_ep->events);
> - /* The epoll_data_t union is just opaque data to the kernel,
> - * so we transfer all 64 bits across and need not worry what
> - * actual data type it is.
> + /*
> + * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
> + * non-null pointer, even though this argument is ignored.
> + *
> */
> - ep.data.u64 = tswap64(target_ep->data.u64);
> - unlock_user_struct(target_ep, arg4, 0);
> epp = &ep;
> }
> return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] linux-user: Prevent crash in epoll_ctl
2020-04-17 15:34 [PATCH] linux-user: Prevent crash in epoll_ctl LemonBoy
2020-11-10 17:03 ` Laurent Vivier
@ 2020-11-11 21:37 ` Laurent Vivier
1 sibling, 0 replies; 3+ messages in thread
From: Laurent Vivier @ 2020-11-11 21:37 UTC (permalink / raw)
To: LemonBoy, qemu-devel
Le 17/04/2020 à 17:34, LemonBoy a écrit :
> From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
> From: Giuseppe Musacchio <thatlemon@gmail.com>
> Date: Fri, 17 Apr 2020 17:25:07 +0200
> Subject: [PATCH] linux-user: Prevent crash in epoll_ctl
>
> The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
> do the same and avoid returning EFAULT if garbage is passed instead of a
> valid pointer.
>
> Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
> ---
> linux-user/syscall.c | 26 +++++++++++++++++---------
> 1 file changed, 17 insertions(+), 9 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 674f70e70a..a51ff43f9b 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
> struct epoll_event ep;
> struct epoll_event *epp = 0;
> if (arg4) {
> - struct target_epoll_event *target_ep;
> - if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> - return -TARGET_EFAULT;
> + if (arg2 != EPOLL_CTL_DEL) {
> + struct target_epoll_event *target_ep;
> + if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> + return -TARGET_EFAULT;
> + }
> + ep.events = tswap32(target_ep->events);
> + /*
> + * The epoll_data_t union is just opaque data to the kernel,
> + * so we transfer all 64 bits across and need not worry what
> + * actual data type it is.
> + */
> + ep.data.u64 = tswap64(target_ep->data.u64);
> + unlock_user_struct(target_ep, arg4, 0);
> }
> - ep.events = tswap32(target_ep->events);
> - /* The epoll_data_t union is just opaque data to the kernel,
> - * so we transfer all 64 bits across and need not worry what
> - * actual data type it is.
> + /*
> + * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
> + * non-null pointer, even though this argument is ignored.
> + *
> */
> - ep.data.u64 = tswap64(target_ep->data.u64);
> - unlock_user_struct(target_ep, arg4, 0);
> epp = &ep;
> }
> return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
>
Applied to my linux-user-for-5.2 branch.
Thanks,
Laurent
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-11-11 21:38 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-04-17 15:34 [PATCH] linux-user: Prevent crash in epoll_ctl LemonBoy
2020-11-10 17:03 ` Laurent Vivier
2020-11-11 21:37 ` Laurent Vivier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).