From: Jessica Clarke <jrtc27@jrtc27.com>
To: linux-x86_64@vger.kernel.org
Cc: Jessica Clarke <jrtc27@jrtc27.com>,
Andy Lutomirski <luto@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH v2] x86: Fix x32 System V message queue syscalls
Date: Mon, 12 Oct 2020 14:44:44 +0100 [thread overview]
Message-ID: <20201012134444.1905-1-jrtc27@jrtc27.com> (raw)
In-Reply-To: <1156938F-A9A3-4EE9-B059-2294A0B9FBFE@jrtc27.com>
POSIX specifies that the first field of the supplied msgp, namely mtype,
is a long, not a __kernel_long_t, and it's a user-defined struct due to
the variable-length mtext field so we can't even bend the spec and make
it a __kernel_long_t even if we wanted to. Thus we must use the compat
syscalls on x32 to avoid buffer overreads and overflows in msgsnd and
msgrcv respectively.
Due to erroneously including the first 4 bytes of mtext in the mtype
this would previously also cause non-zero msgtyp arguments for msgrcv to
search for the wrong messages, and if sharing message queues between x32
and non-x32 (i386 or x86_64) processes this would previously cause mtext
to "move" and, depending on the direction and ABI combination, lose the
first 4 bytes.
Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com>
---
I have verified that the test at the end of [1] now gives the correct
result on x32 ("PAYL" not "PAY" as I erroneously claimed it should be in
the above email) and that both i386 and amd64 give the same output with
that test as before.
[1] <1156938F-A9A3-4EE9-B059-2294A0B9FBFE@jrtc27.com>
Changes since v1:
* Uses the same syscall numbers for x32 as amd64 and the current x32
rather than (further) breaking ABI by allocating new ones from the
legacy x32 range
arch/x86/entry/syscalls/syscall_64.tbl | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl
index f30d6ae9a..f462123f3 100644
--- a/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/arch/x86/entry/syscalls/syscall_64.tbl
@@ -77,8 +77,10 @@
66 common semctl sys_semctl
67 common shmdt sys_shmdt
68 common msgget sys_msgget
-69 common msgsnd sys_msgsnd
-70 common msgrcv sys_msgrcv
+69 64 msgsnd sys_msgsnd
+69 x32 msgsnd compat_sys_msgsnd
+70 64 msgrcv sys_msgrcv
+70 x32 msgrcv compat_sys_msgrcv
71 common msgctl sys_msgctl
72 common fcntl sys_fcntl
73 common flock sys_flock
--
2.28.0
next prev parent reply other threads:[~2020-10-12 13:56 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-12 1:48 [PATCH] " Jessica Clarke
2020-10-12 3:02 ` Andy Lutomirski
2020-10-12 3:31 ` Jessica Clarke
2020-10-12 13:44 ` Jessica Clarke [this message]
2020-10-30 19:21 ` [PATCH v2] " Jessica Clarke
2020-10-31 23:30 ` Andy Lutomirski
2020-11-01 0:09 ` Jessica Clarke
2020-11-01 1:22 ` Rich Felker
2020-11-01 1:27 ` Jessica Clarke
2020-11-01 1:50 ` Rich Felker
2020-11-01 18:07 ` Andy Lutomirski
2020-11-01 18:15 ` Jessica Clarke
2020-11-01 18:27 ` Jessica Clarke
2020-11-01 21:01 ` Rich Felker
2020-11-16 0:55 ` Jessica Clarke
2020-12-06 0:01 ` Jessica Clarke
2020-12-06 22:55 ` Andy Lutomirski
2023-08-01 0:43 ` Harald van Dijk
2023-08-01 1:38 ` Jessica Clarke
2023-08-01 2:53 ` Rich Felker
2023-08-01 12:13 ` Harald van Dijk
2023-09-10 23:33 ` [PATCH 1/2] uapi: Stop using __kernel_long_t in struct msgbuf Harald van Dijk
2023-09-10 23:33 ` [PATCH 2/2] uapi: Remove struct msgbuf, struct ipc_kludge Harald van Dijk
2023-08-01 7:15 ` [PATCH v2] x86: Fix x32 System V message queue syscalls Florian Weimer
2023-08-01 12:15 ` Harald van Dijk
2023-09-10 23:40 ` Harald van Dijk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201012134444.1905-1-jrtc27@jrtc27.com \
--to=jrtc27@jrtc27.com \
--cc=bp@alien8.de \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-x86_64@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®