* [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG
@ 2020-05-07 13:03 Stephen Long
2020-05-07 19:58 ` Laurent Vivier
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Stephen Long @ 2020-05-07 13:03 UTC (permalink / raw)
To: qemu-devel; +Cc: riku.voipio, laurent, apazos
The bug was triggered by the following code on aarch64-linux-user:
#include <signal.h>
#include <sys/prctl.h>
int main(void)
{
int PDeathSig = 0;
if (prctl(PR_GET_PDEATHSIG, &PDeathSig) == 0 && PDeathSig == SIGKILL)
prctl(PR_GET_PDEATHSIG, 0);
return (PDeathSig == SIGKILL);
}
Signed-off-by: Stephen Long <steplong@quicinc.com>
Signed-off-by: Ana Pazos <apazos@quicinc.com>
---
I fixed the incorrect subject line. PR_GETDEATHSIG should be PR_GET_PDEATHSIG.
Is there a test folder where I can include the code that triggered the bug?
Also, I thought "int" can be 2 bytes on some machines.
linux-user/syscall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 05f03919ff..91f91147ba 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -10256,7 +10256,7 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
int deathsig;
ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
if (!is_error(ret) && arg2
- && put_user_ual(deathsig, arg2)) {
+ && put_user_s32(deathsig, arg2)) {
return -TARGET_EFAULT;
}
return ret;
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG
2020-05-07 13:03 [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG Stephen Long
@ 2020-05-07 19:58 ` Laurent Vivier
2020-09-26 1:56 ` Re: [PATCH] " Stephen Long
2020-09-26 10:20 ` [PATCH v2] " Laurent Vivier
2 siblings, 0 replies; 5+ messages in thread
From: Laurent Vivier @ 2020-05-07 19:58 UTC (permalink / raw)
To: Stephen Long, qemu-devel; +Cc: riku.voipio, Alex Bennée, apazos
Le 07/05/2020 à 15:03, Stephen Long a écrit :
> The bug was triggered by the following code on aarch64-linux-user:
>
> #include <signal.h>
> #include <sys/prctl.h>
>
> int main(void)
> {
> int PDeathSig = 0;
> if (prctl(PR_GET_PDEATHSIG, &PDeathSig) == 0 && PDeathSig == SIGKILL)
> prctl(PR_GET_PDEATHSIG, 0);
> return (PDeathSig == SIGKILL);
> }
>
> Signed-off-by: Stephen Long <steplong@quicinc.com>
> Signed-off-by: Ana Pazos <apazos@quicinc.com>
> ---
>
> I fixed the incorrect subject line. PR_GETDEATHSIG should be PR_GET_PDEATHSIG.
> Is there a test folder where I can include the code that triggered the bug?
Perhaps Alex Bennée knows?
> Also, I thought "int" can be 2 bytes on some machines.
According to my K&R, 4th edition, it could be on 16bit systems, like
PDP-11, but we don't support them ;)
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
>
> linux-user/syscall.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 05f03919ff..91f91147ba 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -10256,7 +10256,7 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
> int deathsig;
> ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
> if (!is_error(ret) && arg2
> - && put_user_ual(deathsig, arg2)) {
> + && put_user_s32(deathsig, arg2)) {
> return -TARGET_EFAULT;
> }
> return ret;
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Re: [PATCH] Fix stack smashing when handling PR_GET_PDEATHSIG
2020-05-07 13:03 [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG Stephen Long
2020-05-07 19:58 ` Laurent Vivier
@ 2020-09-26 1:56 ` Stephen Long
2020-09-26 10:24 ` Laurent Vivier
2020-09-26 10:20 ` [PATCH v2] " Laurent Vivier
2 siblings, 1 reply; 5+ messages in thread
From: Stephen Long @ 2020-09-26 1:56 UTC (permalink / raw)
To: qemu-devel; +Cc: laurent
>> linux-user/syscall.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
>> index 05f0391..91f9114 100644
>> --- a/linux-user/syscall.c
>> +++ b/linux-user/syscall.c
>> @@ -10256,7 +10256,7 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
>> int deathsig;
>> ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
>> if (!is_error(ret) && arg2
>> - && put_user_ual(deathsig, arg2)) {
>> + && put_user_s32(deathsig, arg2)) {
>> return -TARGET_EFAULT;
>> }
>> return ret;
Hi Laurent, is it possible to get this patch into master?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG
2020-05-07 13:03 [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG Stephen Long
2020-05-07 19:58 ` Laurent Vivier
2020-09-26 1:56 ` Re: [PATCH] " Stephen Long
@ 2020-09-26 10:20 ` Laurent Vivier
2 siblings, 0 replies; 5+ messages in thread
From: Laurent Vivier @ 2020-09-26 10:20 UTC (permalink / raw)
To: Stephen Long, qemu-devel; +Cc: riku.voipio, apazos
Le 07/05/2020 à 15:03, Stephen Long a écrit :
> The bug was triggered by the following code on aarch64-linux-user:
>
> #include <signal.h>
> #include <sys/prctl.h>
>
> int main(void)
> {
> int PDeathSig = 0;
> if (prctl(PR_GET_PDEATHSIG, &PDeathSig) == 0 && PDeathSig == SIGKILL)
> prctl(PR_GET_PDEATHSIG, 0);
> return (PDeathSig == SIGKILL);
> }
>
> Signed-off-by: Stephen Long <steplong@quicinc.com>
> Signed-off-by: Ana Pazos <apazos@quicinc.com>
> ---
>
> I fixed the incorrect subject line. PR_GETDEATHSIG should be PR_GET_PDEATHSIG.
> Is there a test folder where I can include the code that triggered the bug?
> Also, I thought "int" can be 2 bytes on some machines.
>
> linux-user/syscall.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 05f03919ff..91f91147ba 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -10256,7 +10256,7 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
> int deathsig;
> ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
> if (!is_error(ret) && arg2
> - && put_user_ual(deathsig, arg2)) {
> + && put_user_s32(deathsig, arg2)) {
> return -TARGET_EFAULT;
> }
> return ret;
>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Fix stack smashing when handling PR_GET_PDEATHSIG
2020-09-26 1:56 ` Re: [PATCH] " Stephen Long
@ 2020-09-26 10:24 ` Laurent Vivier
0 siblings, 0 replies; 5+ messages in thread
From: Laurent Vivier @ 2020-09-26 10:24 UTC (permalink / raw)
To: Stephen Long, qemu-devel
Le 26/09/2020 à 03:56, Stephen Long a écrit :
>>> linux-user/syscall.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
>>> index 05f0391..91f9114 100644
>>> --- a/linux-user/syscall.c
>>> +++ b/linux-user/syscall.c
>>> @@ -10256,7 +10256,7 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
>>> int deathsig;
>>> ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
>>> if (!is_error(ret) && arg2
>>> - && put_user_ual(deathsig, arg2)) {
>>> + && put_user_s32(deathsig, arg2)) {
>>> return -TARGET_EFAULT;
>>> }
>>> return ret;
>
> Hi Laurent, is it possible to get this patch into master?
>
Applied to my linux-user-for-5.2 branch.
Thanks,
Laurent
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-09-26 10:27 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-07 13:03 [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG Stephen Long
2020-05-07 19:58 ` Laurent Vivier
2020-09-26 1:56 ` Re: [PATCH] " Stephen Long
2020-09-26 10:24 ` Laurent Vivier
2020-09-26 10:20 ` [PATCH v2] " Laurent Vivier
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.