A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 10:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

ipc: compat: use signed size_t types for msgsnd and msgrcv

Browse source 
The msgsnd and msgrcv system calls use size_t to represent the size of the
message being transferred.  POSIX states that values of msgsz greater than
SSIZE_MAX cause the result to be implementation-defined.  On Linux, this
equates to returning -EINVAL if (long) msgsz < 0.

For compat tasks where !CONFIG_ARCH_WANT_OLD_COMPAT_IPC and compat_size_t
is smaller than size_t, negative size values passed from userspace will be
interpreted as positive values by do_msg{rcv,snd} and will fail to exit
early with -EINVAL.

This patch changes the compat prototypes for msg{rcv,snd} so that the
message size is represented as a compat_ssize_t, which we cast to the
native ssize_t type for the core IPC code.

Cc: Arnd Bergmann <[email protected]>
Acked-by: Chris Metcalf <[email protected]>
Acked-by: Catalin Marinas <[email protected]>
Signed-off-by: Will Deacon <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Will Deacon 2012-07-30 14:42:43 -07:00 • committed by Linus Torvalds
commit 05ba3f1aa1
2 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
ipc/compat.c
View file

@ -373,21 +373,21 @@ long compat_sys_semctl(int semid, int semnum, int cmd, int arg)
}
long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
size_t msgsz, int msgflg)
compat_ssize_t msgsz, int msgflg)
{
compat_long_t mtype;
if (get_user(mtype, &msgp->mtype))
return -EFAULT;
return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
return do_msgsnd(msqid, mtype, msgp->mtext, (ssize_t)msgsz, msgflg);
}
long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
size_t msgsz, long msgtyp, int msgflg)
compat_ssize_t msgsz, long msgtyp, int msgflg)
{
long err, mtype;
err = do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
err = do_msgrcv(msqid, &mtype, msgp->mtext, (ssize_t)msgsz, msgtyp, msgflg);
if (err < 0)
goto out;