system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-07-21 10:24:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

linux-user: Fix 'semop()' and 'semtimedop()' implementation

Browse source 
The implementations of syscalls 'semop()' and 'semtimedop()' in
file 'syscall.c' use function 'target_to_host_sembuf()' to convert
values of 'struct sembuf' from host to target. However, before this
conversion it should be check whether the number of semaphore operations
'nsops' is not bigger than maximum allowed semaphor operations per
syscall: 'SEMOPM'. In these cases, errno 'E2BIG' ("Arg list too long")
should be set. But the implementation will set errno 'EFAULT' ("Bad address")
in this case since the conversion from target to host in this case fails.

This was confirmed with the LTP test for 'semop()' ('ipc/semop/semop02') in
test case where 'nsops' is greater than SEMOPM with unaproppriate errno EFAULT:

semop02.c:130: FAIL: semop failed unexpectedly; expected: E2BIG: EFAULT (14)

This patch changes this by adding a check whether 'nsops' is bigger than
'SEMOPM' before the conversion function 'target_to_host_sembuf()' is called.
After the changes from this patch, the test works fine along with the other
LTP testcases for 'semop()'):

semop02.c:126: PASS: semop failed as expected: E2BIG (7)

Implementation notes:

    A target value ('TARGET_SEMOPM') was added for 'SEMOPM' as to be sure
    in case the value is not available for some targets.

Signed-off-by: Filip Bozuta <Filip.Bozuta@syrmia.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20200818180722.45089-1-Filip.Bozuta@syrmia.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This commit is contained in:
Filip Bozuta 2020-08-18 20:07:22 +02:00 committed by Laurent Vivier
parent 25f6dc28a3
commit 0a7ec8493d
2 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
linux-user/syscall.c
View file

@ -3901,7 +3901,7 @@ static inline abi_long do_semtimedop(int semid,
unsigned nsops,
abi_long timeout)
{
struct sembuf sops[nsops];
struct sembuf *sops;
struct timespec ts, *pts = NULL;
abi_long ret;
@ -3912,8 +3912,16 @@ static inline abi_long do_semtimedop(int semid,
}
}
if (target_to_host_sembuf(sops, ptr, nsops))
if (nsops > TARGET_SEMOPM) {
return -TARGET_E2BIG;
}
sops = g_new(struct sembuf, nsops);
if (target_to_host_sembuf(sops, ptr, nsops)) {
g_free(sops);
return -TARGET_EFAULT;
}
ret = -TARGET_ENOSYS;
#ifdef __NR_semtimedop
@ -3925,6 +3933,7 @@ static inline abi_long do_semtimedop(int semid,
SEMTIMEDOP_IPC_ARGS(nsops, sops, (long)pts)));
}
#endif
g_free(sops);
return ret;
}
#endif

2
linux-user/syscall_defs.h
View file

@ -46,6 +46,8 @@
#define IPCOP_shmget 23
#define IPCOP_shmctl 24
#define TARGET_SEMOPM 500
/*
* The following is for compatibility across the various Linux
* platforms. The i386 ioctl numbering scheme doesn't really enforce