diff options
| author | mrg <mrg@NetBSD.org> | 2019-02-21 03:37:18 +0000 |
|---|---|---|
| committer | mrg <mrg@NetBSD.org> | 2019-02-21 03:37:18 +0000 |
| commit | 202a012a37f604bb73280afaa035ecf4754e5c54 (patch) | |
| tree | 9f0fb0bec060ac1c0ea2868f0fef7eb7a6faf9b8 /sys/compat/linux32/common | |
| parent | 03989db4acadf041591f952b9504463a2be85ae9 (diff) | |
for sysv ipc stat operations, explicitly copy the exported parts
instead of the whole ds structure.
besides triggering a recently added assert in netbsd32, this stops
exposing kernel addresses.
copy the mode clamping to 0777 from sem to shm and msg.
while here, make sure that the compat callers to sysv_ipc clear
the contents of the compat structure before setting the result
members to ensure padding bytes are cleared.
don't set/copy _sem_base, _msg_first, _msg_last or _shm_internal.
even if used, which seems very dodgy, they leak KVAs as well.
possibly this may affect linux binaries, in particular, the
comments around _shm_internal ("XXX Oh well.") may mean apps
rely upon these but hopefully not -- the comments date back to
rev 1.1 in 1995.
the _key, _seq and _msg_cbytes members are exported as before as
i found multiple consumers of these (no less than ipcs(1), and
they appear to be useful for debugging and more.
XXX: the naming of compat functions have too many styles. there
are at least 3 different ones changed here.
Diffstat (limited to 'sys/compat/linux32/common')
| -rw-r--r-- | sys/compat/linux32/common/linux32_ipccall.c | 36 |
1 files changed, 20 insertions, 16 deletions
diff --git a/sys/compat/linux32/common/linux32_ipccall.c b/sys/compat/linux32/common/linux32_ipccall.c index 622f13b0ec4..ab756022423 100644 --- a/sys/compat/linux32/common/linux32_ipccall.c +++ b/sys/compat/linux32/common/linux32_ipccall.c @@ -1,4 +1,4 @@ -/* $NetBSD: linux32_ipccall.c,v 1.11 2010/05/29 18:55:34 dholland Exp $ */ +/* $NetBSD: linux32_ipccall.c,v 1.12 2019/02/21 03:37:18 mrg Exp $ */ /* * Copyright (c) 2008 Nicolas Joly @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: linux32_ipccall.c,v 1.11 2010/05/29 18:55:34 dholland Exp $"); +__KERNEL_RCSID(0, "$NetBSD: linux32_ipccall.c,v 1.12 2019/02/21 03:37:18 mrg Exp $"); #if defined(_KERNEL_OPT) #include "opt_sysv.h" @@ -157,13 +157,14 @@ linux32_sys_ipc(struct lwp *l, const struct linux32_sys_ipc_args *uap, default: return ENOSYS; } - } #if defined(SYSVSEM) || defined (SYSVMSG) || defined(SYSVSHM) static void bsd_to_linux32_ipc_perm(struct ipc_perm *bpp, struct linux32_ipc_perm *lpp) { + + memset(lpp, 0, sizeof *lpp); lpp->l_key = bpp->_key; lpp->l_uid = bpp->uid; lpp->l_gid = bpp->gid; @@ -176,6 +177,7 @@ bsd_to_linux32_ipc_perm(struct ipc_perm *bpp, struct linux32_ipc_perm *lpp) static void linux32_to_bsd_ipc_perm(struct linux32_ipc_perm *lpp, struct ipc_perm *bpp) { + bpp->_key = lpp->l_key; bpp->uid = lpp->l_uid; bpp->gid = lpp->l_gid; @@ -188,6 +190,8 @@ linux32_to_bsd_ipc_perm(struct linux32_ipc_perm *lpp, struct ipc_perm *bpp) static void bsd_to_linux32_ipc64_perm(struct ipc_perm *bpp, struct linux32_ipc64_perm *lpp) { + + memset(lpp, 0, sizeof *lpp); lpp->l_key = bpp->_key; lpp->l_uid = bpp->uid; lpp->l_gid = bpp->gid; @@ -200,6 +204,7 @@ bsd_to_linux32_ipc64_perm(struct ipc_perm *bpp, struct linux32_ipc64_perm *lpp) static void linux32_to_bsd_ipc64_perm(struct linux32_ipc64_perm *lpp, struct ipc_perm *bpp) { + bpp->_key = lpp->l_key; bpp->uid = lpp->l_uid; bpp->gid = lpp->l_gid; @@ -214,16 +219,19 @@ linux32_to_bsd_ipc64_perm(struct linux32_ipc64_perm *lpp, struct ipc_perm *bpp) static void bsd_to_linux32_semid_ds(struct semid_ds *bsp, struct linux32_semid_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc_perm(&bsp->sem_perm, &lsp->l_sem_perm); lsp->l_sem_otime = bsp->sem_otime; lsp->l_sem_ctime = bsp->sem_ctime; lsp->l_sem_nsems = bsp->sem_nsems; - NETBSD32PTR32(lsp->l_sem_base, bsp->_sem_base); } static void bsd_to_linux32_semid64_ds(struct semid_ds *bsp, struct linux32_semid64_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc64_perm(&bsp->sem_perm, &lsp->l_sem_perm); lsp->l_sem_otime = bsp->sem_otime; lsp->l_sem_ctime = bsp->sem_ctime; @@ -237,7 +245,6 @@ linux32_to_bsd_semid_ds(struct linux32_semid_ds *lsp, struct semid_ds *bsp) bsp->sem_otime = lsp->l_sem_otime; bsp->sem_ctime = lsp->l_sem_ctime; bsp->sem_nsems = lsp->l_sem_nsems; - bsp->_sem_base = NETBSD32PTR64(lsp->l_sem_base); } static void @@ -428,8 +435,6 @@ linux32_to_bsd_msqid_ds(struct linux32_msqid_ds *lmp, struct msqid_ds *bmp) memset(bmp, 0, sizeof(*bmp)); linux32_to_bsd_ipc_perm(&lmp->l_msg_perm, &bmp->msg_perm); - bmp->_msg_first = NETBSD32PTR64(lmp->l_msg_first); - bmp->_msg_last = NETBSD32PTR64(lmp->l_msg_last); bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_qnum = lmp->l_msg_qnum; bmp->msg_qbytes = lmp->l_msg_qbytes; @@ -444,12 +449,11 @@ static void linux32_to_bsd_msqid64_ds(struct linux32_msqid64_ds *lmp, struct msqid_ds *bmp) { - memset(bmp, 0, sizeof(*bmp)); linux32_to_bsd_ipc64_perm(&lmp->l_msg_perm, &bmp->msg_perm); + bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_stime = lmp->l_msg_stime; bmp->msg_rtime = lmp->l_msg_rtime; bmp->msg_ctime = lmp->l_msg_ctime; - bmp->_msg_cbytes = lmp->l_msg_cbytes; bmp->msg_qnum = lmp->l_msg_qnum; bmp->msg_qbytes = lmp->l_msg_qbytes; bmp->msg_lspid = lmp->l_msg_lspid; @@ -462,8 +466,6 @@ bsd_to_linux32_msqid_ds(struct msqid_ds *bmp, struct linux32_msqid_ds *lmp) memset(lmp, 0, sizeof(*lmp)); bsd_to_linux32_ipc_perm(&bmp->msg_perm, &lmp->l_msg_perm); - NETBSD32PTR32(lmp->l_msg_first, bmp->_msg_first); - NETBSD32PTR32(lmp->l_msg_last, bmp->_msg_last); lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_qnum = bmp->msg_qnum; lmp->l_msg_qbytes = bmp->msg_qbytes; @@ -480,10 +482,10 @@ bsd_to_linux32_msqid64_ds(struct msqid_ds *bmp, struct linux32_msqid64_ds *lmp) memset(lmp, 0, sizeof(*lmp)); bsd_to_linux32_ipc64_perm(&bmp->msg_perm, &lmp->l_msg_perm); + lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_stime = bmp->msg_stime; lmp->l_msg_rtime = bmp->msg_rtime; lmp->l_msg_ctime = bmp->msg_ctime; - lmp->l_msg_cbytes = bmp->_msg_cbytes; lmp->l_msg_qnum = bmp->msg_qnum; lmp->l_msg_qbytes = bmp->msg_qbytes; lmp->l_msg_lspid = bmp->msg_lspid; @@ -550,6 +552,8 @@ linux32_msgctl(struct lwp *l, const struct linux32_sys_ipc_args *uap, register_t static void bsd_to_linux32_shmid_ds(struct shmid_ds *bsp, struct linux32_shmid_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc_perm(&bsp->shm_perm, &lsp->l_shm_perm); lsp->l_shm_segsz = bsp->shm_segsz; lsp->l_shm_atime = bsp->shm_atime; @@ -558,12 +562,12 @@ bsd_to_linux32_shmid_ds(struct shmid_ds *bsp, struct linux32_shmid_ds *lsp) lsp->l_shm_cpid = bsp->shm_cpid; lsp->l_shm_lpid = bsp->shm_lpid; lsp->l_shm_nattch = bsp->shm_nattch; - NETBSD32PTR32(lsp->l_private2, bsp->_shm_internal); } static void linux32_to_bsd_shmid_ds(struct linux32_shmid_ds *lsp, struct shmid_ds *bsp) { + linux32_to_bsd_ipc_perm(&lsp->l_shm_perm, &bsp->shm_perm); bsp->shm_segsz = lsp->l_shm_segsz; bsp->shm_atime = lsp->l_shm_atime; @@ -572,12 +576,13 @@ linux32_to_bsd_shmid_ds(struct linux32_shmid_ds *lsp, struct shmid_ds *bsp) bsp->shm_cpid = lsp->l_shm_cpid; bsp->shm_lpid = lsp->l_shm_lpid; bsp->shm_nattch = lsp->l_shm_nattch; - bsp->_shm_internal = NETBSD32PTR64(lsp->l_private2); } static void bsd_to_linux32_shmid64_ds(struct shmid_ds *bsp, struct linux32_shmid64_ds *lsp) { + + memset(lsp, 0, sizeof *lsp); bsd_to_linux32_ipc64_perm(&bsp->shm_perm, &lsp->l_shm_perm); lsp->l_shm_segsz = bsp->shm_segsz; lsp->l_shm_atime = bsp->shm_atime; @@ -586,12 +591,12 @@ bsd_to_linux32_shmid64_ds(struct shmid_ds *bsp, struct linux32_shmid64_ds *lsp) lsp->l_shm_cpid = bsp->shm_cpid; lsp->l_shm_lpid = bsp->shm_lpid; lsp->l_shm_nattch = bsp->shm_nattch; - lsp->l___unused5 = NETBSD32PTR32I(bsp->_shm_internal); } static void linux32_to_bsd_shmid64_ds(struct linux32_shmid64_ds *lsp, struct shmid_ds *bsp) { + linux32_to_bsd_ipc64_perm(&lsp->l_shm_perm, &bsp->shm_perm); bsp->shm_segsz = lsp->l_shm_segsz; bsp->shm_atime = lsp->l_shm_atime; @@ -600,7 +605,6 @@ linux32_to_bsd_shmid64_ds(struct linux32_shmid64_ds *lsp, struct shmid_ds *bsp) bsp->shm_cpid = lsp->l_shm_cpid; bsp->shm_lpid = lsp->l_shm_lpid; bsp->shm_nattch = lsp->l_shm_nattch; - bsp->_shm_internal = NETBSD32IPTR64(lsp->l___unused5); } static int |
