The patch titled
Subject: ipc: compat: use signed size_t types for msgsnd and msgrcv
has been added to the -mm tree. Its filename is
ipc-compat-use-signed-size_t-types-for-msgsnd-and-msgrcv.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Will Deacon <will.deacon@xxxxxxx>
Subject: ipc: compat: use signed size_t types for msgsnd and msgrcv
The msgsnd and msgrcv system calls use size_t to represent the size of the
message being transferred. POSIX states that values of msgsz greater than
SSIZE_MAX cause the result to be implementation-defined. On Linux, this
equates to returning -EINVAL if (long) msgsz < 0.
For compat tasks where !CONFIG_ARCH_WANT_OLD_COMPAT_IPC and compat_size_t
is smaller than size_t, negative size values passed from userspace will be
interpreted as positive values by do_msg{rcv,snd} and will fail to exit
early with -EINVAL.
This patch changes the compat prototypes for msg{rcv,snd} so that the
message size is represented as a compat_ssize_t, which we cast to the
native ssize_t type for the core IPC code.
Cc: Arnd Bergmann <arnd@xxxxxxxx>
Acked-by: Chris Metcalf <cmetcalf@xxxxxxxxxx>
Acked-by: Catalin Marinas <catalin.marinas@xxxxxxx>
Signed-off-by: Will Deacon <will.deacon@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
include/linux/compat.h | 4 ++--
ipc/compat.c | 8 ++++----
2 files changed, 6 insertions(+), 6 deletions(-)
diff -puN include/linux/compat.h~ipc-compat-use-signed-size_t-types-for-msgsnd-and-msgrcv include/linux/compat.h
--- a/include/linux/compat.h~ipc-compat-use-signed-size_t-types-for-msgsnd-and-msgrcv
+++ a/include/linux/compat.h
@@ -266,9 +266,9 @@ long compat_sys_shmat(int first, int sec
#else
long compat_sys_semctl(int semid, int semnum, int cmd, int arg);
long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
- size_t msgsz, int msgflg);
+ compat_ssize_t msgsz, int msgflg);
long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
- size_t msgsz, long msgtyp, int msgflg);
+ compat_ssize_t msgsz, long msgtyp, int msgflg);
long compat_sys_shmat(int shmid, compat_uptr_t shmaddr, int shmflg);
#endif
long compat_sys_msgctl(int first, int second, void __user *uptr);
diff -puN ipc/compat.c~ipc-compat-use-signed-size_t-types-for-msgsnd-and-msgrcv ipc/compat.c
--- a/ipc/compat.c~ipc-compat-use-signed-size_t-types-for-msgsnd-and-msgrcv
+++ a/ipc/compat.c
@@ -373,21 +373,21 @@ long compat_sys_semctl(int semid, int se
}
long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
- size_t msgsz, int msgflg)
+ compat_ssize_t msgsz, int msgflg)
{
compat_long_t mtype;
if (get_user(mtype, &msgp->mtype))
return -EFAULT;
- return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
+ return do_msgsnd(msqid, mtype, msgp->mtext, (ssize_t)msgsz, msgflg);
}
long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
- size_t msgsz, long msgtyp, int msgflg)
+ compat_ssize_t msgsz, long msgtyp, int msgflg)
{
long err, mtype;
- err = do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
+ err = do_msgrcv(msqid, &mtype, msgp->mtext, (ssize_t)msgsz, msgtyp, msgflg);
if (err < 0)
goto out;
_
Subject: Subject: ipc: compat: use signed size_t types for msgsnd and msgrcv
Patches currently in -mm which might be from will.deacon@xxxxxxx are
linux-next.patch
ipc-add-compat_shmlba-support.patch
ipc-allow-compat-ipc-version-field-parsing-if-arch_want_old_compat_ipc.patch
ipc-compat-use-signed-size_t-types-for-msgsnd-and-msgrcv.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
