diff mbox series

linux-user: Prevent crash in epoll_ctl

Message ID a244fa67-dace-abdb-995a-3198bd80fee8@gmail.com (mailing list archive)
State New, archived
Headers show
Series linux-user: Prevent crash in epoll_ctl | expand

Commit Message

Giuseppe Musacchio April 17, 2020, 3:34 p.m. UTC
From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
From: Giuseppe Musacchio <thatlemon@gmail.com>
Date: Fri, 17 Apr 2020 17:25:07 +0200
Subject: [PATCH] linux-user: Prevent crash in epoll_ctl

The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
do the same and avoid returning EFAULT if garbage is passed instead of a
valid pointer.

Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
---
 linux-user/syscall.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

Comments

Laurent Vivier Nov. 10, 2020, 5:03 p.m. UTC | #1
Le 17/04/2020 à 17:34, LemonBoy a écrit :
> From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
> From: Giuseppe Musacchio <thatlemon@gmail.com>
> Date: Fri, 17 Apr 2020 17:25:07 +0200
> Subject: [PATCH] linux-user: Prevent crash in epoll_ctl
> 
> The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
> do the same and avoid returning EFAULT if garbage is passed instead of a
> valid pointer.
> 
> Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
> ---
>  linux-user/syscall.c | 26 +++++++++++++++++---------
>  1 file changed, 17 insertions(+), 9 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 674f70e70a..a51ff43f9b 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
>          struct epoll_event ep;
>          struct epoll_event *epp = 0;
>          if (arg4) {
> -            struct target_epoll_event *target_ep;
> -            if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> -                return -TARGET_EFAULT;
> +            if (arg2 != EPOLL_CTL_DEL) {
> +                struct target_epoll_event *target_ep;
> +                if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> +                    return -TARGET_EFAULT;
> +                }
> +                ep.events = tswap32(target_ep->events);
> +                /*
> +                 * The epoll_data_t union is just opaque data to the kernel,
> +                 * so we transfer all 64 bits across and need not worry what
> +                 * actual data type it is.
> +                 */
> +                ep.data.u64 = tswap64(target_ep->data.u64);
> +                unlock_user_struct(target_ep, arg4, 0);
>              }
> -            ep.events = tswap32(target_ep->events);
> -            /* The epoll_data_t union is just opaque data to the kernel,
> -             * so we transfer all 64 bits across and need not worry what
> -             * actual data type it is.
> +            /*
> +             * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
> +             * non-null pointer, even though this argument is ignored.
> +             *
>               */
> -            ep.data.u64 = tswap64(target_ep->data.u64);
> -            unlock_user_struct(target_ep, arg4, 0);
>              epp = &ep;
>          }
>          return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
> 

Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Laurent Vivier Nov. 11, 2020, 9:37 p.m. UTC | #2
Le 17/04/2020 à 17:34, LemonBoy a écrit :
> From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
> From: Giuseppe Musacchio <thatlemon@gmail.com>
> Date: Fri, 17 Apr 2020 17:25:07 +0200
> Subject: [PATCH] linux-user: Prevent crash in epoll_ctl
> 
> The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
> do the same and avoid returning EFAULT if garbage is passed instead of a
> valid pointer.
> 
> Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
> ---
>  linux-user/syscall.c | 26 +++++++++++++++++---------
>  1 file changed, 17 insertions(+), 9 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 674f70e70a..a51ff43f9b 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -12020,17 +12020,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
>          struct epoll_event ep;
>          struct epoll_event *epp = 0;
>          if (arg4) {
> -            struct target_epoll_event *target_ep;
> -            if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> -                return -TARGET_EFAULT;
> +            if (arg2 != EPOLL_CTL_DEL) {
> +                struct target_epoll_event *target_ep;
> +                if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
> +                    return -TARGET_EFAULT;
> +                }
> +                ep.events = tswap32(target_ep->events);
> +                /*
> +                 * The epoll_data_t union is just opaque data to the kernel,
> +                 * so we transfer all 64 bits across and need not worry what
> +                 * actual data type it is.
> +                 */
> +                ep.data.u64 = tswap64(target_ep->data.u64);
> +                unlock_user_struct(target_ep, arg4, 0);
>              }
> -            ep.events = tswap32(target_ep->events);
> -            /* The epoll_data_t union is just opaque data to the kernel,
> -             * so we transfer all 64 bits across and need not worry what
> -             * actual data type it is.
> +            /*
> +             * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
> +             * non-null pointer, even though this argument is ignored.
> +             *
>               */
> -            ep.data.u64 = tswap64(target_ep->data.u64);
> -            unlock_user_struct(target_ep, arg4, 0);
>              epp = &ep;
>          }
>          return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
> 

Applied to my linux-user-for-5.2 branch.

Thanks,
Laurent
diff mbox series

Patch

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 674f70e70a..a51ff43f9b 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -12020,17 +12020,25 @@  static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
         struct epoll_event ep;
         struct epoll_event *epp = 0;
         if (arg4) {
-            struct target_epoll_event *target_ep;
-            if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
-                return -TARGET_EFAULT;
+            if (arg2 != EPOLL_CTL_DEL) {
+                struct target_epoll_event *target_ep;
+                if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
+                    return -TARGET_EFAULT;
+                }
+                ep.events = tswap32(target_ep->events);
+                /*
+                 * The epoll_data_t union is just opaque data to the kernel,
+                 * so we transfer all 64 bits across and need not worry what
+                 * actual data type it is.
+                 */
+                ep.data.u64 = tswap64(target_ep->data.u64);
+                unlock_user_struct(target_ep, arg4, 0);
             }
-            ep.events = tswap32(target_ep->events);
-            /* The epoll_data_t union is just opaque data to the kernel,
-             * so we transfer all 64 bits across and need not worry what
-             * actual data type it is.
+            /*
+             * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
+             * non-null pointer, even though this argument is ignored.
+             *
              */
-            ep.data.u64 = tswap64(target_ep->data.u64);
-            unlock_user_struct(target_ep, arg4, 0);
             epp = &ep;
         }
         return get_errno(epoll_ctl(arg1, arg2, arg3, epp));