qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [Bug 1805913] [NEW] readdir() returns NULL (errno=EOVERFLOW) for 32-bit user-static qemu on 64-bit host
@ 2018-11-30  0:06 Ke Liu
  2018-12-01 13:44 ` [Qemu-devel] [Bug 1805913] " Kan Li
                   ` (18 more replies)
  0 siblings, 19 replies; 21+ messages in thread
From: Ke Liu @ 2018-11-30  0:06 UTC (permalink / raw)
  To: qemu-devel

Public bug reported:

This can be simply reproduced by compiling and running the attached C
code (readdir-bug.c) under 32-bit user-static qemu, such as qemu-arm-
static:

# Setup docker for user-static binfmt
docker run --rm --privileged multiarch/qemu-user-static:register --reset
# Compile the code and run (readdir for / is fine, so create a new directory /test).
docker run -v /path/to/qemu-arm-static:/usr/bin/qemu-arm-static -v /path/to/readdir-bug.c:/tmp/readdir-bug.c -it --rm arm32v7/ubuntu:18.10 bash -c '{ apt update && apt install -y gcc; } >&/dev/null && mkdir -p /test && cd /test && gcc /tmp/readdir-bug.c && ./a.out'
dir=0xff5b4150
readdir(dir)=(nil)
errno=75: Value too large for defined data type

Do remember to replace the /path/to/qemu-arm-static and /path/to
/readdir-bug.c to the actual paths of the files.

The root cause is in glibc:
https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/getdents.c;h=6d09a5be7057e2792be9150d3a2c7b293cf6fc34;hb=a5275ba5378c9256d18e582572b4315e8edfcbfb#l87

By C standard, the return type of readdir() is DIR*, in which the inode
number and offset are 32-bit integers, therefore, glibc calls
getdents64() and check if the inode number and offset fits the 32-bit
range, and reports EOVERFLOW if not.

The problem here is for 32-bit user-static qemu running on 64-bit host,
getdents64 simply passing through the inode number and offset from
underlying getdents64 syscall (from 64-bit kernel), which is very likely
to not fit into 32-bit range. On real hardware, the 32-bit kernel
creates 32-bit inode numbers, therefore works properly.

The glibc code makes sense to do the check to be conformant with C
standard, therefore ideally it should be a fix on qemu side. I admit
this is difficult because qemu has to maintain a mapping between
underlying 64-bit inode numbers and 32-bit inode numbers, which would
severely hurt the performance. I don't expect this could be fix anytime
soon (or even there would be a fix), but it would be worthwhile to
surface this issue.

** Affects: qemu
     Importance: Undecided
         Status: New


** Tags: linux user-static

** Attachment added: "readdir-bug.c"
   https://bugs.launchpad.net/bugs/1805913/+attachment/5217520/+files/readdir-bug.c

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1805913

Title:
  readdir() returns NULL (errno=EOVERFLOW) for 32-bit user-static qemu
  on 64-bit host

Status in QEMU:
  New

Bug description:
  This can be simply reproduced by compiling and running the attached C
  code (readdir-bug.c) under 32-bit user-static qemu, such as qemu-arm-
  static:

  # Setup docker for user-static binfmt
  docker run --rm --privileged multiarch/qemu-user-static:register --reset
  # Compile the code and run (readdir for / is fine, so create a new directory /test).
  docker run -v /path/to/qemu-arm-static:/usr/bin/qemu-arm-static -v /path/to/readdir-bug.c:/tmp/readdir-bug.c -it --rm arm32v7/ubuntu:18.10 bash -c '{ apt update && apt install -y gcc; } >&/dev/null && mkdir -p /test && cd /test && gcc /tmp/readdir-bug.c && ./a.out'
  dir=0xff5b4150
  readdir(dir)=(nil)
  errno=75: Value too large for defined data type

  Do remember to replace the /path/to/qemu-arm-static and /path/to
  /readdir-bug.c to the actual paths of the files.

  The root cause is in glibc:
  https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/getdents.c;h=6d09a5be7057e2792be9150d3a2c7b293cf6fc34;hb=a5275ba5378c9256d18e582572b4315e8edfcbfb#l87

  By C standard, the return type of readdir() is DIR*, in which the
  inode number and offset are 32-bit integers, therefore, glibc calls
  getdents64() and check if the inode number and offset fits the 32-bit
  range, and reports EOVERFLOW if not.

  The problem here is for 32-bit user-static qemu running on 64-bit
  host, getdents64 simply passing through the inode number and offset
  from underlying getdents64 syscall (from 64-bit kernel), which is very
  likely to not fit into 32-bit range. On real hardware, the 32-bit
  kernel creates 32-bit inode numbers, therefore works properly.

  The glibc code makes sense to do the check to be conformant with C
  standard, therefore ideally it should be a fix on qemu side. I admit
  this is difficult because qemu has to maintain a mapping between
  underlying 64-bit inode numbers and 32-bit inode numbers, which would
  severely hurt the performance. I don't expect this could be fix
  anytime soon (or even there would be a fix), but it would be
  worthwhile to surface this issue.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1805913/+subscriptions

^ permalink raw reply	[flat|nested] 21+ messages in thread

end of thread, other threads:[~2021-05-11  6:20 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-11-30  0:06 [Qemu-devel] [Bug 1805913] [NEW] readdir() returns NULL (errno=EOVERFLOW) for 32-bit user-static qemu on 64-bit host Ke Liu
2018-12-01 13:44 ` [Qemu-devel] [Bug 1805913] " Kan Li
2018-12-05 11:15 ` Alex Bennée
2019-04-16 13:20 ` diddly
2019-04-16 13:20   ` diddly
2019-07-16 14:46 ` Alex Bennée
2019-08-01 13:00 ` diddly
2019-08-01 13:32 ` Peter Maydell
2020-01-30  8:19 ` Philippe Vaucher
2020-01-30  8:20 ` Philippe Vaucher
2020-01-30 10:47 ` diddly
2020-02-02 20:11 ` Philippe Vaucher
2020-02-02 21:01 ` Marcin Konarski
2020-02-06 13:34 ` Philippe Vaucher
2020-03-26 20:16 ` Peter Maydell
2020-03-27 15:19 ` Manuel Reimer
2020-03-27 16:00 ` Peter Maydell
2020-04-03 22:43 ` Eicke Herbertz
2021-04-20  8:11 ` Thomas Huth
2021-04-20  9:16 ` Peter Maydell
2021-05-11  5:36 ` Thomas Huth

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).