From patchwork Thu Jun 27 09:39:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 1123209 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=sourceware.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=libc-alpha-return-103222-incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="fJMXWH0q"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 45ZFGx1Czpz9s4Y for ; Thu, 27 Jun 2019 19:39:36 +1000 (AEST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; q=dns; s=default; b=AyAkZHGtwB3513fNS5oqhgHNphGVC /cDuIIV7PtzNbpGafChCQSZg9c0f5mbZD3iom/+d389XrfAP+0vRGRR4eR8OMeBh SDM59Y5ezjxjrBNDAG6DIgTy2LfCZtbK4P41zMZ7pcVdtViSibaYCvz9xN8+N4Xv 3najTCzGR3qrC4= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:date:message-id:mime-version :content-type; s=default; bh=H1bu67ttW+Ij4eBu54YctPwF6yI=; b=fJM XWH0qYv6jpFv8hZIUvrHuN08HQ6DicWKdL6qHzPyHYeHFcQ7+VYU2+3V2jzt2Q75 rDH5hAAyTP+lnQ7j4kWtQ/pI/5iDS9bGhyWrn7HOhP3HhpzwU5TbcGXO3Wg3krsR ltI6YMT8mHClSJHzS9rgjCZMYHrgGSiQvRpX+Pqg= Received: (qmail 116318 invoked by alias); 27 Jun 2019 09:39:31 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 116305 invoked by uid 89); 27 Jun 2019 09:39:31 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-18.7 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, SPF_HELO_PASS autolearn=ham version=3.3.1 spammy=2318 X-HELO: mx1.redhat.com From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH] Linux: Adjust gedents64 buffer size to int range [BZ #24740] Date: Thu, 27 Jun 2019 11:39:26 +0200 Message-ID: <87d0izwenl.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.2 (gnu/linux) MIME-Version: 1.0 The kernel interface uses type unsigned int, but there is an internal conversion to int, so INT_MAX is the correct limit. Part of the buffer will always be unused, but this is not a problem. Such huge buffers do not occur in practice anyway. 2019-06-27 Florian Weimer [BZ #24740] * sysdeps/unix/sysv/linux/getdents64.c (__getdents64): Adjust buffer size if necessary. * sysdeps/unix/sysv/linux/mips/mips64/getdents64.c (__getdents64): Likewise. * sysdeps/unix/sysv/linux/tst-getdents64.c (large_buffer_check): New function. (large_buffer_checks): Likewise. (do_test): Call large_buffer_checks. Reviewed-by: Adhemerval Zanella diff --git a/sysdeps/unix/sysv/linux/getdents64.c b/sysdeps/unix/sysv/linux/getdents64.c index a6dd22106d..5e3ef9994e 100644 --- a/sysdeps/unix/sysv/linux/getdents64.c +++ b/sysdeps/unix/sysv/linux/getdents64.c @@ -19,11 +19,16 @@ #include #include #include +#include /* The kernel struct linux_dirent64 matches the 'struct dirent64' type. */ ssize_t __getdents64 (int fd, void *buf, size_t nbytes) { + /* The system call takes an unsigned int argument, and some length + checks in the kernel use an int type. */ + if (nbytes > INT_MAX) + nbytes = INT_MAX; return INLINE_SYSCALL_CALL (getdents64, fd, buf, nbytes); } libc_hidden_def (__getdents64) diff --git a/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c b/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c index 1e22fa4325..8bf3abb0e0 100644 --- a/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c +++ b/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c @@ -23,12 +23,18 @@ #include #include #include +#include ssize_t __getdents64 (int fd, void *buf0, size_t nbytes) { char *buf = buf0; + /* The system call takes an unsigned int argument, and some length + checks in the kernel use an int type. */ + if (nbytes > INT_MAX) + nbytes = INT_MAX; + #ifdef __NR_getdents64 ssize_t ret = INLINE_SYSCALL_CALL (getdents64, fd, buf, nbytes); if (ret != -1) diff --git a/sysdeps/unix/sysv/linux/tst-getdents64.c b/sysdeps/unix/sysv/linux/tst-getdents64.c index c1f7721221..ece46123f3 100644 --- a/sysdeps/unix/sysv/linux/tst-getdents64.c +++ b/sysdeps/unix/sysv/linux/tst-getdents64.c @@ -19,6 +19,7 @@ #include #include #include +#include #include #include #include @@ -28,6 +29,48 @@ #include #include +/* Called by large_buffer_checks below. */ +static void +large_buffer_check (int fd, char *large_buffer, size_t large_buffer_size) +{ + xlseek (fd, 0, SEEK_SET); + ssize_t ret = getdents64 (fd, large_buffer, large_buffer_size); + if (ret < 0) + FAIL_EXIT1 ("getdents64 for buffer of %zu bytes failed: %m", + large_buffer_size); + if (ret < offsetof (struct dirent64, d_name)) + FAIL_EXIT1 ("getdents64 for buffer of %zu returned small value %zd", + large_buffer_size, ret); +} + +/* Bug 24740: Make sure that the system call argument is adjusted + properly for the int type. A large value should stay a large + value, and not wrap around to something small, causing the system + call to fail with EINVAL. */ +static void +large_buffer_checks (int fd) +{ + size_t large_buffer_size = UINT_MAX; + large_buffer_size += 2; + if (large_buffer_size > 2) + { + char *large_buffer = malloc (large_buffer_size); + if (large_buffer == NULL) + printf ("warning: could not allocate %zu bytes of memory," + " subtests skipped\n", large_buffer_size); + else + { + large_buffer_check (fd, large_buffer, INT_MAX); + large_buffer_check (fd, large_buffer, (size_t) INT_MAX + 1); + large_buffer_check (fd, large_buffer, (size_t) INT_MAX + 2); + large_buffer_check (fd, large_buffer, UINT_MAX); + large_buffer_check (fd, large_buffer, (size_t) UINT_MAX + 1); + large_buffer_check (fd, large_buffer, (size_t) UINT_MAX + 2); + } + free (large_buffer); + } +} + static int do_test (void) { @@ -105,6 +148,8 @@ do_test (void) rewinddir (reference); } + large_buffer_checks (fd); + xclose (fd); closedir (reference); return 0;