From: Andreas Schwab <schwab@suse.de>
To: Laurent Vivier <laurent@vivier.eu>
Cc: qemu-devel@nongnu.org, Riku Voipio <riku.voipio@iki.fi>
Subject: [Qemu-devel] [PATCH] linux-user: fix emulation of accept4/getpeername/getsockname/recvfrom syscalls
Date: Thu, 14 Feb 2019 12:43:40 +0100 [thread overview]
Message-ID: <mvmimxmppcj.fsf_-_@suse.de> (raw)
In-Reply-To: <3c8aca9d-e47e-04a7-1e6a-a65deab125ce@vivier.eu> (Laurent Vivier's message of "Thu, 14 Feb 2019 10:17:39 +0100")
System calls that return a socket address do so by writing the (possibly
truncated) address into the provided buffer space, but setting the
addrlen parameter to the actual size of the address. To determine how
much to copy back to the target memory the emulation needs to remember
the incoming value of the addrlen parameter, so that it doesn't write
past the buffer limits.
Signed-off-by: Andreas Schwab <schwab@suse.de>
---
linux-user/syscall.c | 41 +++++++++++++++++++++++++----------------
1 file changed, 25 insertions(+), 16 deletions(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 4a320850bb..f24743a2b2 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2885,7 +2885,7 @@ static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
static abi_long do_accept4(int fd, abi_ulong target_addr,
abi_ulong target_addrlen_addr, int flags)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
abi_long ret;
int host_flags;
@@ -2909,11 +2909,13 @@ static abi_long do_accept4(int fd, abi_ulong target_addr,
addr = alloca(addrlen);
- ret = get_errno(safe_accept4(fd, addr, &addrlen, host_flags));
+ ret_addrlen = addrlen;
+ ret = get_errno(safe_accept4(fd, addr, &ret_addrlen, host_flags));
if (!is_error(ret)) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen_addr))
+ host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
ret = -TARGET_EFAULT;
+ }
}
return ret;
}
@@ -2922,7 +2924,7 @@ static abi_long do_accept4(int fd, abi_ulong target_addr,
static abi_long do_getpeername(int fd, abi_ulong target_addr,
abi_ulong target_addrlen_addr)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
abi_long ret;
@@ -2938,11 +2940,13 @@ static abi_long do_getpeername(int fd, abi_ulong target_addr,
addr = alloca(addrlen);
- ret = get_errno(getpeername(fd, addr, &addrlen));
+ ret_addrlen = addrlen;
+ ret = get_errno(getpeername(fd, addr, &ret_addrlen));
if (!is_error(ret)) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen_addr))
+ host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
ret = -TARGET_EFAULT;
+ }
}
return ret;
}
@@ -2951,7 +2955,7 @@ static abi_long do_getpeername(int fd, abi_ulong target_addr,
static abi_long do_getsockname(int fd, abi_ulong target_addr,
abi_ulong target_addrlen_addr)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
abi_long ret;
@@ -2967,11 +2971,13 @@ static abi_long do_getsockname(int fd, abi_ulong target_addr,
addr = alloca(addrlen);
- ret = get_errno(getsockname(fd, addr, &addrlen));
+ ret_addrlen = addrlen;
+ ret = get_errno(getsockname(fd, addr, &ret_addrlen));
if (!is_error(ret)) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen_addr))
+ host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
ret = -TARGET_EFAULT;
+ }
}
return ret;
}
@@ -3043,7 +3049,7 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
abi_ulong target_addr,
abi_ulong target_addrlen)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
void *host_msg;
abi_long ret;
@@ -3061,10 +3067,12 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
goto fail;
}
addr = alloca(addrlen);
+ ret_addrlen = addrlen;
ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
- addr, &addrlen));
+ addr, &ret_addrlen));
} else {
addr = NULL; /* To keep compiler quiet. */
+ addrlen = 0; /* To keep compiler quiet. */
ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
}
if (!is_error(ret)) {
@@ -3077,8 +3085,9 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
}
}
if (target_addr) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen)) {
+ host_to_target_sockaddr(target_addr, addr,
+ MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen)) {
ret = -TARGET_EFAULT;
goto fail;
}
--
2.20.1
next prev parent reply other threads:[~2019-02-14 11:44 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-07 14:51 [Qemu-devel] [PATCH] linux-user: fix emulation of accept4/getpeername/getsockname/recvfrom syscalls Andreas Schwab
2019-02-07 15:22 ` no-reply
2019-02-07 15:26 ` no-reply
2019-02-14 9:17 ` Laurent Vivier
2019-02-14 11:43 ` Andreas Schwab [this message]
2019-02-14 13:27 ` Laurent Vivier
2019-02-14 13:25 ` Laurent Vivier
-- strict thread matches above, loose matches on Subject: below --
2019-01-28 10:46 Andreas Schwab
2019-01-31 18:07 ` no-reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=mvmimxmppcj.fsf_-_@suse.de \
--to=schwab@suse.de \
--cc=laurent@vivier.eu \
--cc=qemu-devel@nongnu.org \
--cc=riku.voipio@iki.fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).