[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 1/2] linux-user: Fix unaligned memory access in prlimit64 syscall
From: |
Ilya Leoshkevich |
Subject: |
[PATCH 1/2] linux-user: Fix unaligned memory access in prlimit64 syscall |
Date: |
Thu, 23 Feb 2023 22:58:33 +0100 |
32-bit guests may enforce only 4-byte alignment for target_rlimit64,
whereas 64-bit hosts normally require the 8-byte one. Therefore
accessing this struct directly is UB.
Fix by adding a local copy.
Fixes: 163a05a8398b ("linux-user: Implement prlimit64 syscall")
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
linux-user/syscall.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index a6c426d73cf..8ae7696d8f1 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -12876,7 +12876,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int
num, abi_long arg1,
case TARGET_NR_prlimit64:
{
/* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
- struct target_rlimit64 *target_rnew, *target_rold;
+ struct target_rlimit64 *target_rnew, *target_rold, tmp;
struct host_rlimit64 rnew, rold, *rnewp = 0;
int resource = target_to_host_resource(arg2);
@@ -12886,8 +12886,9 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int
num, abi_long arg1,
if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
return -TARGET_EFAULT;
}
- rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
- rnew.rlim_max = tswap64(target_rnew->rlim_max);
+ memcpy(&tmp, target_rnew, sizeof(tmp));
+ rnew.rlim_cur = tswap64(tmp.rlim_cur);
+ rnew.rlim_max = tswap64(tmp.rlim_max);
unlock_user_struct(target_rnew, arg3, 0);
rnewp = &rnew;
}
@@ -12897,8 +12898,9 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int
num, abi_long arg1,
if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
return -TARGET_EFAULT;
}
- target_rold->rlim_cur = tswap64(rold.rlim_cur);
- target_rold->rlim_max = tswap64(rold.rlim_max);
+ tmp.rlim_cur = tswap64(rold.rlim_cur);
+ tmp.rlim_max = tswap64(rold.rlim_max);
+ memcpy(target_rold, &tmp, sizeof(*target_rold));
unlock_user_struct(target_rold, arg4, 1);
}
return ret;
--
2.39.1