| Message ID | a244fa67-dace-abdb-995a-3198bd80fee8@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | linux-user: Prevent crash in epoll_ctl | expand |
Le 17/04/2020 à 17:34, LemonBoy a écrit : > From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001 > From: Giuseppe Musacchio <thatlemon@gmail.com> > Date: Fri, 17 Apr 2020 17:25:07 +0200 > Subject: [PATCH] linux-user: Prevent crash in epoll_ctl > > The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL, > do the same and avoid returning EFAULT if garbage is passed instead of a > valid pointer. > > Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com> > --- > linux-user/syscall.c | 26 +++++++++++++++++--------- > 1 file changed, 17 insertions(+), 9 deletions(-) > > diff --git a/linux-user/syscall.c b/linux-user/syscall.c > index 674f70e70a..a51ff43f9b 100644 > --- a/linux-user/syscall.c > +++ b/linux-user/syscall.c > @@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1, > struct epoll_event ep; > struct epoll_event *epp = 0; > if (arg4) { > - struct target_epoll_event *target_ep; > - if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) { > - return -TARGET_EFAULT; > + if (arg2 != EPOLL_CTL_DEL) { > + struct target_epoll_event *target_ep; > + if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) { > + return -TARGET_EFAULT; > + } > + ep.events = tswap32(target_ep->events); > + /* > + * The epoll_data_t union is just opaque data to the kernel, > + * so we transfer all 64 bits across and need not worry what > + * actual data type it is. > + */ > + ep.data.u64 = tswap64(target_ep->data.u64); > + unlock_user_struct(target_ep, arg4, 0); > } > - ep.events = tswap32(target_ep->events); > - /* The epoll_data_t union is just opaque data to the kernel, > - * so we transfer all 64 bits across and need not worry what > - * actual data type it is. > + /* > + * before kernel 2.6.9, EPOLL_CTL_DEL operation required a > + * non-null pointer, even though this argument is ignored. > + * > */ > - ep.data.u64 = tswap64(target_ep->data.u64); > - unlock_user_struct(target_ep, arg4, 0); > epp = &ep; > } > return get_errno(epoll_ctl(arg1, arg2, arg3, epp)); > Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Le 17/04/2020 à 17:34, LemonBoy a écrit : > From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001 > From: Giuseppe Musacchio <thatlemon@gmail.com> > Date: Fri, 17 Apr 2020 17:25:07 +0200 > Subject: [PATCH] linux-user: Prevent crash in epoll_ctl > > The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL, > do the same and avoid returning EFAULT if garbage is passed instead of a > valid pointer. > > Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com> > --- > linux-user/syscall.c | 26 +++++++++++++++++--------- > 1 file changed, 17 insertions(+), 9 deletions(-) > > diff --git a/linux-user/syscall.c b/linux-user/syscall.c > index 674f70e70a..a51ff43f9b 100644 > --- a/linux-user/syscall.c > +++ b/linux-user/syscall.c > @@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1, > struct epoll_event ep; > struct epoll_event *epp = 0; > if (arg4) { > - struct target_epoll_event *target_ep; > - if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) { > - return -TARGET_EFAULT; > + if (arg2 != EPOLL_CTL_DEL) { > + struct target_epoll_event *target_ep; > + if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) { > + return -TARGET_EFAULT; > + } > + ep.events = tswap32(target_ep->events); > + /* > + * The epoll_data_t union is just opaque data to the kernel, > + * so we transfer all 64 bits across and need not worry what > + * actual data type it is. > + */ > + ep.data.u64 = tswap64(target_ep->data.u64); > + unlock_user_struct(target_ep, arg4, 0); > } > - ep.events = tswap32(target_ep->events); > - /* The epoll_data_t union is just opaque data to the kernel, > - * so we transfer all 64 bits across and need not worry what > - * actual data type it is. > + /* > + * before kernel 2.6.9, EPOLL_CTL_DEL operation required a > + * non-null pointer, even though this argument is ignored. > + * > */ > - ep.data.u64 = tswap64(target_ep->data.u64); > - unlock_user_struct(target_ep, arg4, 0); > epp = &ep; > } > return get_errno(epoll_ctl(arg1, arg2, arg3, epp)); > Applied to my linux-user-for-5.2 branch. Thanks, Laurent
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 674f70e70a..a51ff43f9b 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1, struct epoll_event ep; struct epoll_event *epp = 0; if (arg4) { - struct target_epoll_event *target_ep; - if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) { - return -TARGET_EFAULT; + if (arg2 != EPOLL_CTL_DEL) { + struct target_epoll_event *target_ep; + if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) { + return -TARGET_EFAULT; + } + ep.events = tswap32(target_ep->events); + /* + * The epoll_data_t union is just opaque data to the kernel, + * so we transfer all 64 bits across and need not worry what + * actual data type it is. + */ + ep.data.u64 = tswap64(target_ep->data.u64); + unlock_user_struct(target_ep, arg4, 0); } - ep.events = tswap32(target_ep->events); - /* The epoll_data_t union is just opaque data to the kernel, - * so we transfer all 64 bits across and need not worry what - * actual data type it is. + /* + * before kernel 2.6.9, EPOLL_CTL_DEL operation required a + * non-null pointer, even though this argument is ignored. + * */ - ep.data.u64 = tswap64(target_ep->data.u64); - unlock_user_struct(target_ep, arg4, 0); epp = &ep; } return get_errno(epoll_ctl(arg1, arg2, arg3, epp));