[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 4/9] linux-user: fix emulation of accept4/getpeername
From: |
Laurent Vivier |
Subject: |
[Qemu-devel] [PULL 4/9] linux-user: fix emulation of accept4/getpeername/getsockname/recvfrom syscalls |
Date: |
Thu, 7 Mar 2019 11:06:51 +0100 |
From: Andreas Schwab <address@hidden>
System calls that return a socket address do so by writing the (possibly
truncated) address into the provided buffer space, but setting the
addrlen parameter to the actual size of the address. To determine how
much to copy back to the target memory the emulation needs to remember
the incoming value of the addrlen parameter, so that it doesn't write
past the buffer limits.
Signed-off-by: Andreas Schwab <address@hidden>
Reviewed-by: Laurent Vivier <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Laurent Vivier <address@hidden>
---
linux-user/syscall.c | 41 +++++++++++++++++++++++++----------------
1 file changed, 25 insertions(+), 16 deletions(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index f380048cbd8b..5f72209debc9 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2847,7 +2847,7 @@ static abi_long do_sendrecvmmsg(int fd, abi_ulong
target_msgvec,
static abi_long do_accept4(int fd, abi_ulong target_addr,
abi_ulong target_addrlen_addr, int flags)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
abi_long ret;
int host_flags;
@@ -2871,11 +2871,13 @@ static abi_long do_accept4(int fd, abi_ulong
target_addr,
addr = alloca(addrlen);
- ret = get_errno(safe_accept4(fd, addr, &addrlen, host_flags));
+ ret_addrlen = addrlen;
+ ret = get_errno(safe_accept4(fd, addr, &ret_addrlen, host_flags));
if (!is_error(ret)) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen_addr))
+ host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
ret = -TARGET_EFAULT;
+ }
}
return ret;
}
@@ -2884,7 +2886,7 @@ static abi_long do_accept4(int fd, abi_ulong target_addr,
static abi_long do_getpeername(int fd, abi_ulong target_addr,
abi_ulong target_addrlen_addr)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
abi_long ret;
@@ -2900,11 +2902,13 @@ static abi_long do_getpeername(int fd, abi_ulong
target_addr,
addr = alloca(addrlen);
- ret = get_errno(getpeername(fd, addr, &addrlen));
+ ret_addrlen = addrlen;
+ ret = get_errno(getpeername(fd, addr, &ret_addrlen));
if (!is_error(ret)) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen_addr))
+ host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
ret = -TARGET_EFAULT;
+ }
}
return ret;
}
@@ -2913,7 +2917,7 @@ static abi_long do_getpeername(int fd, abi_ulong
target_addr,
static abi_long do_getsockname(int fd, abi_ulong target_addr,
abi_ulong target_addrlen_addr)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
abi_long ret;
@@ -2929,11 +2933,13 @@ static abi_long do_getsockname(int fd, abi_ulong
target_addr,
addr = alloca(addrlen);
- ret = get_errno(getsockname(fd, addr, &addrlen));
+ ret_addrlen = addrlen;
+ ret = get_errno(getsockname(fd, addr, &ret_addrlen));
if (!is_error(ret)) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen_addr))
+ host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
ret = -TARGET_EFAULT;
+ }
}
return ret;
}
@@ -3005,7 +3011,7 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, size_t
len, int flags,
abi_ulong target_addr,
abi_ulong target_addrlen)
{
- socklen_t addrlen;
+ socklen_t addrlen, ret_addrlen;
void *addr;
void *host_msg;
abi_long ret;
@@ -3023,10 +3029,12 @@ static abi_long do_recvfrom(int fd, abi_ulong msg,
size_t len, int flags,
goto fail;
}
addr = alloca(addrlen);
+ ret_addrlen = addrlen;
ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
- addr, &addrlen));
+ addr, &ret_addrlen));
} else {
addr = NULL; /* To keep compiler quiet. */
+ addrlen = 0; /* To keep compiler quiet. */
ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
}
if (!is_error(ret)) {
@@ -3039,8 +3047,9 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, size_t
len, int flags,
}
}
if (target_addr) {
- host_to_target_sockaddr(target_addr, addr, addrlen);
- if (put_user_u32(addrlen, target_addrlen)) {
+ host_to_target_sockaddr(target_addr, addr,
+ MIN(addrlen, ret_addrlen));
+ if (put_user_u32(ret_addrlen, target_addrlen)) {
ret = -TARGET_EFAULT;
goto fail;
}
--
2.20.1
- [Qemu-devel] [PULL 0/9] Linux user for 4.0 patches, Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 4/9] linux-user: fix emulation of accept4/getpeername/getsockname/recvfrom syscalls,
Laurent Vivier <=
- [Qemu-devel] [PULL 2/9] linux-user: Add ELF_PLATFORM for arm, Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 3/9] linux-user: Fix ELF_PLATFORM for aarch64_be-linux-user, Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 6/9] linux-user: don't short-circuit read with zero length, Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 7/9] linux-user: fix "may be used uninitialized" warnings, Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 8/9] linux-user: Nicer strace output of chroot() syscall, Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 5/9] Fix breakpoint support in Nios II user-mode emulation., Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 1/9] linux-user: fix recvmsg emulation, Laurent Vivier, 2019/03/07
- [Qemu-devel] [PULL 9/9] linux-user: add new netlink types, Laurent Vivier, 2019/03/07
- Re: [Qemu-devel] [PULL 0/9] Linux user for 4.0 patches, Peter Maydell, 2019/03/08