ipc: compat: use signed size_t types for msgsnd and msgrcv (05ba3f1a) · Commits · 戴 / test

The msgsnd and msgrcv system calls use size_t to represent the size of the message being transferred. POSIX states that values of msgsz greater than SSIZE_MAX cause the result to be implementation-defined. On Linux, this equates to returning -EINVAL if (long) msgsz < 0. For compat tasks where !CONFIG_ARCH_WANT_OLD_COMPAT_IPC and compat_size_t is smaller than size_t, negative size values passed from userspace will be interpreted as positive values by do_msg{rcv,snd} and will fail to exit early with -EINVAL. This patch changes the compat prototypes for msg{rcv,snd} so that the message size is represented as a compat_ssize_t, which we cast to the native ssize_t type for the core IPC code. Cc: Arnd Bergmann <arnd@arndb.de> Acked-by:

Chris Metcalf <cmetcalf@tilera.com> Acked-by:

Catalin Marinas <catalin.marinas@arm.com> Signed-off-by:

Will Deacon <will.deacon@arm.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

include/linux/compat.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -266,9 +266,9 @@ long compat_sys_shmat(int first, int second, compat_uptr_t third, int version,
		#else
		long compat_sys_semctl(int semid, int semnum, int cmd, int arg);
		long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
		size_t msgsz, int msgflg);
		compat_ssize_t msgsz, int msgflg);
		long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
		size_t msgsz, long msgtyp, int msgflg);
		compat_ssize_t msgsz, long msgtyp, int msgflg);
		long compat_sys_shmat(int shmid, compat_uptr_t shmaddr, int shmflg);
		#endif
		long compat_sys_msgctl(int first, int second, void __user *uptr);

ipc/compat.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -373,21 +373,21 @@ long compat_sys_semctl(int semid, int semnum, int cmd, int arg)
		}

		long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
		size_t msgsz, int msgflg)
		compat_ssize_t msgsz, int msgflg)
		{
		compat_long_t mtype;

		if (get_user(mtype, &msgp->mtype))
		return -EFAULT;
		return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
		return do_msgsnd(msqid, mtype, msgp->mtext, (ssize_t)msgsz, msgflg);
		}

		long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
		size_t msgsz, long msgtyp, int msgflg)
		compat_ssize_t msgsz, long msgtyp, int msgflg)
		{
		long err, mtype;

		err = do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
		err = do_msgrcv(msqid, &mtype, msgp->mtext, (ssize_t)msgsz, msgtyp, msgflg);
		if (err < 0)
		goto out;

Admin message