[PATCH] sendfile compat functions on x86_64 and ia64

[Alexey Toptygin <alexeyt@freeshell.org>]

Hi,

I'm a kernel noob, so I apologise in advance if I completely misunderstood 
something. In arch/x86_64/ia32/sys_ia32.c there is this code:

sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, s32 count)
[snip]
	ret = sys_sendfile(out_fd, in_fd, offset ? &of : NULL, count);

However on ia32, count (a size_t) is u32. I think this is taking the u32 
value from the 32 bit userland, sign-extending it to 64 bits, then giving 
it to sys_sendfile in a u64. So, a count >= 1<<31 passed from the 32 bit 
app will become a count >= ((1<<33)-1)<<31 given to sys_sendfile.

Now, I don't think this actually hurts anything, because sys_sendfile 
passes a max of ((1<<31)-1) to do_sendfile, plus rw_verify_area will 
reject values that are negative when cast to ssize_t; but, this is 
certainly confusing.

Perhaps that s32 should be changed to a compat_size_t? ISTM that's 
what compat_size_t is for. And if so, the equivalent function in 
arch/ia64/ia32/sys_ia32.c:

sys32_sendfile (int out_fd, int in_fd, int __user *offset, unsigned int count)

should probably be changed as well? In case I'm not completely wrong, 
below is a patch. Please CC: me, I'm not on lkml.

Signed-off-by: Alexey Toptygin <alexeyt@freeshell.org>

diff -urpN linux-source-2.6.16/arch/ia64/ia32/sys_ia32.c linux-source-2.6.16-mine/arch/ia64/ia32/sys_ia32.c
--- linux-source-2.6.16/arch/ia64/ia32/sys_ia32.c	2006-03-20 00:53:29.000000000 -0500
+++ linux-source-2.6.16-mine/arch/ia64/ia32/sys_ia32.c	2006-05-04 20:20:44.000000000 -0400
@@ -2306,7 +2306,8 @@ sys32_pwrite (unsigned int fd, void __us
 }
 
 asmlinkage long
-sys32_sendfile (int out_fd, int in_fd, int __user *offset, unsigned int count)
+sys32_sendfile (int out_fd, int in_fd, compat_off_t __user *offset,
+							compat_size_t count)
 {
 	mm_segment_t old_fs = get_fs();
 	long ret;
diff -urpN linux-source-2.6.16/arch/x86_64/ia32/sys_ia32.c linux-source-2.6.16-mine/arch/x86_64/ia32/sys_ia32.c
--- linux-source-2.6.16/arch/x86_64/ia32/sys_ia32.c	2006-03-20 00:53:29.000000000 -0500
+++ linux-source-2.6.16-mine/arch/x86_64/ia32/sys_ia32.c	2006-05-04 20:19:35.000000000 -0400
@@ -760,7 +760,8 @@ sys32_personality(unsigned long personal
 }
 
 asmlinkage long
-sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, s32 count)
+sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset,
+							compat_size_t count)
 {
 	mm_segment_t old_fs = get_fs();
 	int ret;