qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH v2] linux-user: fix emulation of getdents


From: Peter Maydell
Subject: Re: [Qemu-devel] [PATCH v2] linux-user: fix emulation of getdents
Date: Mon, 20 Aug 2012 17:17:57 +0100

On 18 August 2012 22:56, Dmitry V. Levin <address@hidden> wrote:
> In case when TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64, the last
> byte of the target dirent structure (aka d_type byte) was never copied
> from the host dirent structure, thus breaking everything that relies
> on valid d_type value, e.g. glob(3).
>
> Signed-off-by: Dmitry V. Levin <address@hidden>
> ---
>  linux-user/syscall.c      | 8 ++++----
>  linux-user/syscall_defs.h | 3 ++-
>  2 files changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 41c869b..adc3270 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -7030,10 +7030,10 @@ abi_long do_syscall(void *cpu_env, int num, abi_long 
> arg1,
>                      tde->d_ino = tswapal(de->d_ino);
>                      tde->d_off = tswapal(de->d_off);
>                     tnamelen = treclen - (2 * sizeof(abi_long) + 2);

Incidentally I think this would be clearer as
  tnamelen = treclen - offsetof(target_dirent, d_name);

> -                   if (tnamelen > 256)
> -                        tnamelen = 256;
> -                    /* XXX: may not be correct */
> -                    pstrcpy(tde->d_name, tnamelen, de->d_name);
> +                    if (tnamelen > sizeof(tde->d_name)) {
> +                        tnamelen = sizeof(tde->d_name);
> +                    }
> +                    memcpy(tde->d_name, de->d_name, tnamelen);

Why are we limiting the amount copied to sizeof(tde->d_name) in the
first place? The only actual limit we care about is that we mustn't
overrun the guest's overall buffer size (and I assert that we can't
do that because sizeof(target_dirent) <= sizeof(linux_dirent). We
could even assert in the code that we don't write more than 'count'
bytes to the guest buffer...

As far as I can tell the kernel doesn't impose any particular limit
on the filesize; we should just copy all of the record as defined
by d_reclen.

>                      de = (struct linux_dirent *)((char *)de + reclen);
>                      len -= reclen;
>                      tde = (struct target_dirent *)((char *)tde + treclen);
> diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
> index 2cfda5a..19fe414 100644
> --- a/linux-user/syscall_defs.h
> +++ b/linux-user/syscall_defs.h
> @@ -258,7 +258,8 @@ struct target_dirent {
>         abi_long        d_ino;
>         abi_long        d_off;
>         unsigned short  d_reclen;
> -       char            d_name[256]; /* We must not include limits.h! */
> +       char            d_name[257];    /* 257 = NAME_MAX + '\0' + d_type, */
> +                                        /* we must not include limits.h! */
>  };

...and if we did that we could make d_name[] a flexible
array member, ie "char d_name[];".

-- PMM



reply via email to

[Prev in Thread] Current Thread [Next in Thread]