From nobody Tue May 7 04:14:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@gnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@gnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1506909890076950.966415912239; Sun, 1 Oct 2017 19:04:50 -0700 (PDT) Received: from localhost ([::1]:50329 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dyq61-0005CF-21 for importer@patchew.org; Sun, 01 Oct 2017 22:04:37 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34047) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dyq57-0004pe-90 for qemu-devel@nongnu.org; Sun, 01 Oct 2017 22:03:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dyq53-00022g-BS for qemu-devel@nongnu.org; Sun, 01 Oct 2017 22:03:41 -0400 Received: from mail-pg0-x241.google.com ([2607:f8b0:400e:c05::241]:36322) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dyq53-00022K-4H for qemu-devel@nongnu.org; Sun, 01 Oct 2017 22:03:37 -0400 Received: by mail-pg0-x241.google.com with SMTP id d8so4394738pgt.3 for ; Sun, 01 Oct 2017 19:03:36 -0700 (PDT) Received: from localhost.localdomain (c-73-189-82-67.hsd1.ca.comcast.net. [73.189.82.67]) by smtp.gmail.com with ESMTPSA id 207sm14662567pfu.0.2017.10.01.19.03.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 01 Oct 2017 19:03:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=mBkHwcxYLiiKJZgxr04wmBxpAshyC0ryp35OEUoJBQc=; b=Hupte8IEC/S0Wa1JJLjzxtHWVbLd1OBlTJ8cYGacAET4OrO5aSRp9HfDOvHgobbSn0 LxuKpv/A/hJfdAMa+kAI0ByIT0MZVTAen1UfMvbQcN+N80Y/rbhR3rsH9vSIOZ6gzReE Q+wXVbOGoW67A+5SI2ue7nhTHkRyKjsPm3GNYP2GXJ9O/W1y9G/W6wBO3mN0O5cVU34F T4cINoiVmN8aqplie6r5qvMVozqkQkvs63barCBNtjg8J8HE2AcVPaX1JBP8KrnzfXc9 bGA9W9vN3oONfQCYVAy7IYlf8YC6OBwxzNuGT3gfvPKJ49ez84edHmwt9aTsMOMT8SZJ H1Dw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=mBkHwcxYLiiKJZgxr04wmBxpAshyC0ryp35OEUoJBQc=; b=EzMLEV5ActEKECWYMSImJq+0t5qSx6VFGQD63jMTOLuRpzc8B3jXB9bnv90SL0DCih vL7BUSotpwoYRtat1+i0Is8tKXBIl92zB0cxaSI+PCPuI48EqQ98JaEylZcpJSU4JoOd 5RZsWpVXcOXRPeVY6HnKOk9EV2IEUSroUXaDNWdcH3pdvOJbZAh/e5rMLApcBgNQZsDc rk+A7Le5GbTKiSp8re3BfuD7guNTE+y/Ao3ym4SZqQz+fgzQCt+Zo6AaEzGIFsFsg3B9 p8TeBnvd07YOILtOdRF+R+936QYUINlFuRrq5unqE6OMVkOfy1DsWnF1ZfmsU+kIvy7e yB0w== X-Gm-Message-State: AHPjjUgPhTwWL152rtO0c3JRQogpzZwtAi4zUy+4ZnJR097ZhCRTxV6l zalvhES9qBQmuJwXTSOHGOtuw3mx X-Google-Smtp-Source: AOwi7QAy6wzj9zH7tjR0qlIR72HHWBg5TJJf+mRMwOIR8g9k4TSJJ55dM07BPb9qwICTx09sVmWEmA== X-Received: by 10.98.194.148 with SMTP id w20mr13614900pfk.299.1506909815680; Sun, 01 Oct 2017 19:03:35 -0700 (PDT) From: =?UTF-8?q?Carlo=20Marcelo=20Arenas=20Bel=C3=B3n?= To: qemu-devel@nongnu.org Date: Sun, 1 Oct 2017 19:01:32 -0700 Message-Id: <20171002020132.28762-1-carenas@gmail.com> X-Mailer: git-send-email 2.14.2 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:400e:c05::241 Subject: [Qemu-devel] [PATCH] linux-user: avoid EFAULT when NULL is passed as buffer for [p]write[64] X-BeenThere: qemu-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.com, zhuoweizhang@yahoo.com, laurent@vivier.eu, =?UTF-8?q?Carlo=20Marcelo=20Arenas=20Bel=C3=B3n?= Errors-To: qemu-devel-bounces+importer=patchew.org@gnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 as documented in write(2)[1], if count is zero and fd refers to a regular file the syscall might return 0 (if error detection is not performed). the current version of the code will force and EFAULT if the buffer was pointing to NULL and therefore will result in the following call failing: write(fd, NULL, 0) instead of failing early, pass the call to the host instead so that any further checks could be done there and the documented shortcut could be used. [1] http://man7.org/linux/man-pages/man2/write.2.html#RETURN_VALUE Reported-by: Zhuowei Zhang Signed-off-by: Carlo Marcelo Arenas Bel=C3=B3n --- linux-user/syscall.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 9b6364a266..c0171e4d8c 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -7783,8 +7783,10 @@ abi_long do_syscall(void *cpu_env, int num, abi_long= arg1, } break; case TARGET_NR_write: - if (!(p =3D lock_user(VERIFY_READ, arg2, arg3, 1))) + p =3D lock_user(VERIFY_READ, arg2, arg3, 1); + if ((p =3D=3D NULL) && (arg2 !=3D 0)) { goto efault; + } if (fd_trans_target_to_host_data(arg1)) { void *copy =3D g_malloc(arg3); memcpy(copy, p, arg3); @@ -10505,12 +10507,14 @@ abi_long do_syscall(void *cpu_env, int num, abi_l= ong arg1, unlock_user(p, arg2, ret); break; case TARGET_NR_pwrite64: + p =3D lock_user(VERIFY_READ, arg2, arg3, 1); + if ((p =3D=3D NULL) && (arg2 !=3D 0)) { + goto efault; + } if (regpairs_aligned(cpu_env)) { arg4 =3D arg5; arg5 =3D arg6; } - if (!(p =3D lock_user(VERIFY_READ, arg2, arg3, 1))) - goto efault; ret =3D get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, ar= g5))); unlock_user(p, arg2, 0); break; --=20 2.14.2