Re: [Qemu-devel] [PATCH] linux-user/syscall: let recvfrom(struct sockaddr *) use abi_ulong

[Guido Günther]

Hi,
On Tue, Jan 23, 2018 at 05:12:26PM +0100, Laurent Vivier wrote:
> Le 23/01/2018 à 16:23, Guido Günther a écrit :
> > Hi,
> > Thanks for having a look!
> > 
> > On Tue, Jan 23, 2018 at 11:52:22AM -0300, Philippe Mathieu-Daudé wrote:
> >> Currently recvfrom() is restricted to handle 32-bit pointers,
> >> remove this limit for 64-bit hosts.
> >>
> >> This fixes:
> >>
> >>   31572 socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
> >>   ...
> >>   31572 sendto(3, {{len=124, type=0x454 /* NLMSG_??? */, 
> >> flags=NLM_F_REQUEST|NLM_F_ACK, seq=1, pid=0}, "op=test:message acct=\"?\" 
> >> exe=\"/tmp/nl-bad-addr\" hostname=localhost addr=? terminal=/dev/pts/2 
> >> res=success\0\0\0"}, 124, 0, 0xfffffa3897d0, 0) = 124
> >>   31572 ppoll([{fd=3, events=POLLIN}], 1, {tv_sec=0, tv_nsec=500000000}, 
> >> NULL, 0) = 1 ([{fd=3, revents=POLLIN}], left {tv_sec=0, tv_nsec=499993180})
> >>   31572 recvfrom(3, 0x112a50eb4, 8988, MSG_PEEK|MSG_DONTWAIT, 
> >> 0xfffffa3897e0, 0x42) = -1 EFAULT (Bad address)
> >>
> >> Reported-by: Guido Günther <address@hidden>
> >> Message-id: address@hidden
> >> Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
> >> ---
> >>  linux-user/syscall.c | 4 ++--
> >>  1 file changed, 2 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> >> index 11c9116c4a..28805b1785 100644
> >> --- a/linux-user/syscall.c
> >> +++ b/linux-user/syscall.c
> >> @@ -4032,7 +4032,7 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, 
> >> size_t len, int flags,
> >>      if (!host_msg)
> >>          return -TARGET_EFAULT;
> >>      if (target_addr) {
> >> -        if (get_user_u32(addrlen, target_addrlen)) {
> >> +        if (get_user_ual(addrlen, target_addrlen)) {
> >>              ret = -TARGET_EFAULT;
> >>              goto fail;
> >>          }
> >> @@ -4053,7 +4053,7 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, 
> >> size_t len, int flags,
> >>          }
> >>          if (target_addr) {
> >>              host_to_target_sockaddr(target_addr, addr, addrlen);
> >> -            if (put_user_u32(addrlen, target_addrlen)) {
> >> +            if (put_user_ual(addrlen, target_addrlen)) {
> >>                  ret = -TARGET_EFAULT;
> >>                  goto fail;
> >>              }
> > 
> > Ahh...I saw these and was wondering how this would work on
> > 64bit. Unfortunately the patch doesn't change things:
> > 
> >     4824  recvfrom(3, 0x1401f8eb4, 8988, MSG_PEEK|MSG_DONTWAIT, 
> > 0xffffe10a8620, 0x42) = -1 EFAULT (Bad address)
> > 
> > If you want me to report qemu -strace or s.th. please let me know.
> > Cheers,
> >  -- Guido
> > 
> 
> Could you try:
> 
> strace -f chroot . /usr/bin/qemu-arm-static tmp/nl-bad-addr
> 
> to see if the fault comes from the kernel or from QEMU.

Full strace is attached of

    strace -f -s2048 -onl-bad-addr.strace chroot armhf-chroot/ 
tmp/qemu-arm-static tmp/a.out

is attched. The error is at the very end.
Cheers,
 -- Guido

nl-bad-addr.strace
Description: Text document