Hi,
I'm a kernel noob, so I apologise in advance if I completely misunderstood
something. In arch/x86_64/ia32/sys_ia32.c there is this code:
sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, s32 count)
[snip]
ret = sys_sendfile(out_fd, in_fd, offset ? &of : NULL, count);
However on ia32, count (a size_t) is u32. I think this is taking the u32
value from the 32 bit userland, sign-extending it to 64 bits, then giving
it to sys_sendfile in a u64. So, a count >= 1<<31 passed from the 32 bit
app will become a count >= ((1<<33)-1)<<31 given to sys_sendfile.
Now, I don't think this actually hurts anything, because sys_sendfile
passes a max of ((1<<31)-1) to do_sendfile, plus rw_verify_area will
reject values that are negative when cast to ssize_t; but, this is
certainly confusing.
Perhaps that s32 should be changed to a compat_size_t? ISTM that's
what compat_size_t is for. And if so, the equivalent function in
arch/ia64/ia32/sys_ia32.c:
sys32_sendfile (int out_fd, int in_fd, int __user *offset, unsigned int count)
should probably be changed as well? In case I'm not completely wrong,
below is a patch. Please CC: me, I'm not on lkml.
Signed-off-by: Alexey Toptygin <[email protected]>
diff -urpN linux-source-2.6.16/arch/ia64/ia32/sys_ia32.c linux-source-2.6.16-mine/arch/ia64/ia32/sys_ia32.c
--- linux-source-2.6.16/arch/ia64/ia32/sys_ia32.c 2006-03-20 00:53:29.000000000 -0500
+++ linux-source-2.6.16-mine/arch/ia64/ia32/sys_ia32.c 2006-05-04 20:20:44.000000000 -0400
@@ -2306,7 +2306,8 @@ sys32_pwrite (unsigned int fd, void __us
}
asmlinkage long
-sys32_sendfile (int out_fd, int in_fd, int __user *offset, unsigned int count)
+sys32_sendfile (int out_fd, int in_fd, compat_off_t __user *offset,
+ compat_size_t count)
{
mm_segment_t old_fs = get_fs();
long ret;
diff -urpN linux-source-2.6.16/arch/x86_64/ia32/sys_ia32.c linux-source-2.6.16-mine/arch/x86_64/ia32/sys_ia32.c
--- linux-source-2.6.16/arch/x86_64/ia32/sys_ia32.c 2006-03-20 00:53:29.000000000 -0500
+++ linux-source-2.6.16-mine/arch/x86_64/ia32/sys_ia32.c 2006-05-04 20:19:35.000000000 -0400
@@ -760,7 +760,8 @@ sys32_personality(unsigned long personal
}
asmlinkage long
-sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, s32 count)
+sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset,
+ compat_size_t count)
{
mm_segment_t old_fs = get_fs();
int ret;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
