| Message ID | 1467648378-26630-3-git-send-email-peter.maydell@linaro.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Le 04/07/2016 à 18:06, Peter Maydell a écrit : > The BLKSSZGET ioctl takes an argument which is a pointer to an int. > We were incorrectly declaring it to take a pointer to a long, which > meant that we would incorrectly write to memory which we should not > if the guest is a 64-bit architecture. > > In particular, kpartx uses this ioctl to write to an int on the > stack, which tends to result in it crashing immediately. > > Reported-by: Chanho Park <chanho61.park@samsung.com> > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> > --- > linux-user/ioctls.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h > index 72cd32a..8978eb3 100644 > --- a/linux-user/ioctls.h > +++ b/linux-user/ioctls.h > @@ -76,7 +76,7 @@ > IOCTL(BLKFLSBUF, 0, TYPE_NULL) > IOCTL(BLKRASET, 0, TYPE_INT) > IOCTL(BLKRAGET, IOC_R, MK_PTR(TYPE_LONG)) > - IOCTL(BLKSSZGET, IOC_R, MK_PTR(TYPE_LONG)) > + IOCTL(BLKSSZGET, IOC_R, MK_PTR(TYPE_INT)) > IOCTL(BLKBSZGET, IOC_R, MK_PTR(TYPE_INT)) > IOCTL_SPECIAL(BLKPG, IOC_W, do_ioctl_blkpg, > MK_PTR(MK_STRUCT(STRUCT_blkpg_ioctl_arg))) >
diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h index 72cd32a..8978eb3 100644 --- a/linux-user/ioctls.h +++ b/linux-user/ioctls.h @@ -76,7 +76,7 @@ IOCTL(BLKFLSBUF, 0, TYPE_NULL) IOCTL(BLKRASET, 0, TYPE_INT) IOCTL(BLKRAGET, IOC_R, MK_PTR(TYPE_LONG)) - IOCTL(BLKSSZGET, IOC_R, MK_PTR(TYPE_LONG)) + IOCTL(BLKSSZGET, IOC_R, MK_PTR(TYPE_INT)) IOCTL(BLKBSZGET, IOC_R, MK_PTR(TYPE_INT)) IOCTL_SPECIAL(BLKPG, IOC_W, do_ioctl_blkpg, MK_PTR(MK_STRUCT(STRUCT_blkpg_ioctl_arg)))
The BLKSSZGET ioctl takes an argument which is a pointer to an int. We were incorrectly declaring it to take a pointer to a long, which meant that we would incorrectly write to memory which we should not if the guest is a 64-bit architecture. In particular, kpartx uses this ioctl to write to an int on the stack, which tends to result in it crashing immediately. Reported-by: Chanho Park <chanho61.park@samsung.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- linux-user/ioctls.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)