[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] Fix buffer overrun in sched_getaffinity
From: |
Stefan Hajnoczi |
Subject: |
Re: [Qemu-devel] [PATCH] Fix buffer overrun in sched_getaffinity |
Date: |
Sat, 16 Apr 2011 10:16:23 +0100 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Tue, Apr 12, 2011 at 12:48:20PM +0900, Mike McCormack wrote:
> Zeroing of the cpu array should start from &cpus[kernel_ret]
> not &cpus[num_zeros_to_fill].
>
> This fixes a crash in EFL's edje_cc running under qemu-arm.
>
> Signed-off-by: Mike McCormack <address@hidden>
> ---
> linux-user/syscall.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index bb0999d..1cda10a 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long
> arg1,
> unsigned long zero = arg2 - ret;
> p = alloca(zero);
> memset(p, 0, zero);
> - if (copy_to_user(arg3 + zero, p, zero)) {
> + if (copy_to_user(arg3 + ret, p, zero)) {
> goto efault;
> }
> arg2 = ret;
Reviewed-by: Stefan Hajnoczi <address@hidden>
Note that mainline Linux does not zero unwritten bytes. I would drop
the entire arg2 > ret case and instead copy only ret bytes to user.
Stefan