ARM: 6891/1: prevent heap corruption in OABI semtimedop
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / arch / arm / kernel / sys_oabi-compat.c
blobaf0aaebf4de62e16e70fcfcad8ccafece2879217
1 /*
2 * arch/arm/kernel/sys_oabi-compat.c
4 * Compatibility wrappers for syscalls that are used from
5 * old ABI user space binaries with an EABI kernel.
7 * Author: Nicolas Pitre
8 * Created: Oct 7, 2005
9 * Copyright: MontaVista Software, Inc.
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2 as
13 * published by the Free Software Foundation.
17 * The legacy ABI and the new ARM EABI have different rules making some
18 * syscalls incompatible especially with structure arguments.
19 * Most notably, Eabi says 64-bit members should be 64-bit aligned instead of
20 * simply word aligned. EABI also pads structures to the size of the largest
21 * member it contains instead of the invariant 32-bit.
23 * The following syscalls are affected:
25 * sys_stat64:
26 * sys_lstat64:
27 * sys_fstat64:
28 * sys_fstatat64:
30 * struct stat64 has different sizes and some members are shifted
31 * Compatibility wrappers are needed for them and provided below.
33 * sys_fcntl64:
35 * struct flock64 has different sizes and some members are shifted
36 * A compatibility wrapper is needed and provided below.
38 * sys_statfs64:
39 * sys_fstatfs64:
41 * struct statfs64 has extra padding with EABI growing its size from
42 * 84 to 88. This struct is now __attribute__((packed,aligned(4)))
43 * with a small assembly wrapper to force the sz argument to 84 if it is 88
44 * to avoid copying the extra padding over user space unexpecting it.
46 * sys_newuname:
48 * struct new_utsname has no padding with EABI. No problem there.
50 * sys_epoll_ctl:
51 * sys_epoll_wait:
53 * struct epoll_event has its second member shifted also affecting the
54 * structure size. Compatibility wrappers are needed and provided below.
56 * sys_ipc:
57 * sys_semop:
58 * sys_semtimedop:
60 * struct sembuf loses its padding with EABI. Since arrays of them are
61 * used they have to be copyed to remove the padding. Compatibility wrappers
62 * provided below.
64 * sys_bind:
65 * sys_connect:
66 * sys_sendmsg:
67 * sys_sendto:
68 * sys_socketcall:
70 * struct sockaddr_un loses its padding with EABI. Since the size of the
71 * structure is used as a validation test in unix_mkname(), we need to
72 * change the length argument to 110 whenever it is 112. Compatibility
73 * wrappers provided below.
76 #include <linux/syscalls.h>
77 #include <linux/errno.h>
78 #include <linux/fs.h>
79 #include <linux/fcntl.h>
80 #include <linux/eventpoll.h>
81 #include <linux/sem.h>
82 #include <linux/socket.h>
83 #include <linux/net.h>
84 #include <linux/ipc.h>
85 #include <linux/uaccess.h>
86 #include <linux/slab.h>
88 struct oldabi_stat64 {
89 unsigned long long st_dev;
90 unsigned int __pad1;
91 unsigned long __st_ino;
92 unsigned int st_mode;
93 unsigned int st_nlink;
95 unsigned long st_uid;
96 unsigned long st_gid;
98 unsigned long long st_rdev;
99 unsigned int __pad2;
101 long long st_size;
102 unsigned long st_blksize;
103 unsigned long long st_blocks;
105 unsigned long st_atime;
106 unsigned long st_atime_nsec;
108 unsigned long st_mtime;
109 unsigned long st_mtime_nsec;
111 unsigned long st_ctime;
112 unsigned long st_ctime_nsec;
114 unsigned long long st_ino;
115 } __attribute__ ((packed,aligned(4)));
117 static long cp_oldabi_stat64(struct kstat *stat,
118 struct oldabi_stat64 __user *statbuf)
120 struct oldabi_stat64 tmp;
122 tmp.st_dev = huge_encode_dev(stat->dev);
123 tmp.__pad1 = 0;
124 tmp.__st_ino = stat->ino;
125 tmp.st_mode = stat->mode;
126 tmp.st_nlink = stat->nlink;
127 tmp.st_uid = stat->uid;
128 tmp.st_gid = stat->gid;
129 tmp.st_rdev = huge_encode_dev(stat->rdev);
130 tmp.st_size = stat->size;
131 tmp.st_blocks = stat->blocks;
132 tmp.__pad2 = 0;
133 tmp.st_blksize = stat->blksize;
134 tmp.st_atime = stat->atime.tv_sec;
135 tmp.st_atime_nsec = stat->atime.tv_nsec;
136 tmp.st_mtime = stat->mtime.tv_sec;
137 tmp.st_mtime_nsec = stat->mtime.tv_nsec;
138 tmp.st_ctime = stat->ctime.tv_sec;
139 tmp.st_ctime_nsec = stat->ctime.tv_nsec;
140 tmp.st_ino = stat->ino;
141 return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
144 asmlinkage long sys_oabi_stat64(const char __user * filename,
145 struct oldabi_stat64 __user * statbuf)
147 struct kstat stat;
148 int error = vfs_stat(filename, &stat);
149 if (!error)
150 error = cp_oldabi_stat64(&stat, statbuf);
151 return error;
154 asmlinkage long sys_oabi_lstat64(const char __user * filename,
155 struct oldabi_stat64 __user * statbuf)
157 struct kstat stat;
158 int error = vfs_lstat(filename, &stat);
159 if (!error)
160 error = cp_oldabi_stat64(&stat, statbuf);
161 return error;
164 asmlinkage long sys_oabi_fstat64(unsigned long fd,
165 struct oldabi_stat64 __user * statbuf)
167 struct kstat stat;
168 int error = vfs_fstat(fd, &stat);
169 if (!error)
170 error = cp_oldabi_stat64(&stat, statbuf);
171 return error;
174 asmlinkage long sys_oabi_fstatat64(int dfd,
175 const char __user *filename,
176 struct oldabi_stat64 __user *statbuf,
177 int flag)
179 struct kstat stat;
180 int error;
182 error = vfs_fstatat(dfd, filename, &stat, flag);
183 if (error)
184 return error;
185 return cp_oldabi_stat64(&stat, statbuf);
188 struct oabi_flock64 {
189 short l_type;
190 short l_whence;
191 loff_t l_start;
192 loff_t l_len;
193 pid_t l_pid;
194 } __attribute__ ((packed,aligned(4)));
196 asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
197 unsigned long arg)
199 struct oabi_flock64 user;
200 struct flock64 kernel;
201 mm_segment_t fs = USER_DS; /* initialized to kill a warning */
202 unsigned long local_arg = arg;
203 int ret;
205 switch (cmd) {
206 case F_GETLK64:
207 case F_SETLK64:
208 case F_SETLKW64:
209 if (copy_from_user(&user, (struct oabi_flock64 __user *)arg,
210 sizeof(user)))
211 return -EFAULT;
212 kernel.l_type = user.l_type;
213 kernel.l_whence = user.l_whence;
214 kernel.l_start = user.l_start;
215 kernel.l_len = user.l_len;
216 kernel.l_pid = user.l_pid;
217 local_arg = (unsigned long)&kernel;
218 fs = get_fs();
219 set_fs(KERNEL_DS);
222 ret = sys_fcntl64(fd, cmd, local_arg);
224 switch (cmd) {
225 case F_GETLK64:
226 if (!ret) {
227 user.l_type = kernel.l_type;
228 user.l_whence = kernel.l_whence;
229 user.l_start = kernel.l_start;
230 user.l_len = kernel.l_len;
231 user.l_pid = kernel.l_pid;
232 if (copy_to_user((struct oabi_flock64 __user *)arg,
233 &user, sizeof(user)))
234 ret = -EFAULT;
236 case F_SETLK64:
237 case F_SETLKW64:
238 set_fs(fs);
241 return ret;
244 struct oabi_epoll_event {
245 __u32 events;
246 __u64 data;
247 } __attribute__ ((packed,aligned(4)));
249 asmlinkage long sys_oabi_epoll_ctl(int epfd, int op, int fd,
250 struct oabi_epoll_event __user *event)
252 struct oabi_epoll_event user;
253 struct epoll_event kernel;
254 mm_segment_t fs;
255 long ret;
257 if (op == EPOLL_CTL_DEL)
258 return sys_epoll_ctl(epfd, op, fd, NULL);
259 if (copy_from_user(&user, event, sizeof(user)))
260 return -EFAULT;
261 kernel.events = user.events;
262 kernel.data = user.data;
263 fs = get_fs();
264 set_fs(KERNEL_DS);
265 ret = sys_epoll_ctl(epfd, op, fd, &kernel);
266 set_fs(fs);
267 return ret;
270 asmlinkage long sys_oabi_epoll_wait(int epfd,
271 struct oabi_epoll_event __user *events,
272 int maxevents, int timeout)
274 struct epoll_event *kbuf;
275 mm_segment_t fs;
276 long ret, err, i;
278 if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event)))
279 return -EINVAL;
280 kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL);
281 if (!kbuf)
282 return -ENOMEM;
283 fs = get_fs();
284 set_fs(KERNEL_DS);
285 ret = sys_epoll_wait(epfd, kbuf, maxevents, timeout);
286 set_fs(fs);
287 err = 0;
288 for (i = 0; i < ret; i++) {
289 __put_user_error(kbuf[i].events, &events->events, err);
290 __put_user_error(kbuf[i].data, &events->data, err);
291 events++;
293 kfree(kbuf);
294 return err ? -EFAULT : ret;
297 struct oabi_sembuf {
298 unsigned short sem_num;
299 short sem_op;
300 short sem_flg;
301 unsigned short __pad;
304 asmlinkage long sys_oabi_semtimedop(int semid,
305 struct oabi_sembuf __user *tsops,
306 unsigned nsops,
307 const struct timespec __user *timeout)
309 struct sembuf *sops;
310 struct timespec local_timeout;
311 long err;
312 int i;
314 if (nsops < 1 || nsops > SEMOPM)
315 return -EINVAL;
316 sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
317 if (!sops)
318 return -ENOMEM;
319 err = 0;
320 for (i = 0; i < nsops; i++) {
321 __get_user_error(sops[i].sem_num, &tsops->sem_num, err);
322 __get_user_error(sops[i].sem_op, &tsops->sem_op, err);
323 __get_user_error(sops[i].sem_flg, &tsops->sem_flg, err);
324 tsops++;
326 if (timeout) {
327 /* copy this as well before changing domain protection */
328 err |= copy_from_user(&local_timeout, timeout, sizeof(*timeout));
329 timeout = &local_timeout;
331 if (err) {
332 err = -EFAULT;
333 } else {
334 mm_segment_t fs = get_fs();
335 set_fs(KERNEL_DS);
336 err = sys_semtimedop(semid, sops, nsops, timeout);
337 set_fs(fs);
339 kfree(sops);
340 return err;
343 asmlinkage long sys_oabi_semop(int semid, struct oabi_sembuf __user *tsops,
344 unsigned nsops)
346 return sys_oabi_semtimedop(semid, tsops, nsops, NULL);
349 asmlinkage int sys_oabi_ipc(uint call, int first, int second, int third,
350 void __user *ptr, long fifth)
352 switch (call & 0xffff) {
353 case SEMOP:
354 return sys_oabi_semtimedop(first,
355 (struct oabi_sembuf __user *)ptr,
356 second, NULL);
357 case SEMTIMEDOP:
358 return sys_oabi_semtimedop(first,
359 (struct oabi_sembuf __user *)ptr,
360 second,
361 (const struct timespec __user *)fifth);
362 default:
363 return sys_ipc(call, first, second, third, ptr, fifth);
367 asmlinkage long sys_oabi_bind(int fd, struct sockaddr __user *addr, int addrlen)
369 sa_family_t sa_family;
370 if (addrlen == 112 &&
371 get_user(sa_family, &addr->sa_family) == 0 &&
372 sa_family == AF_UNIX)
373 addrlen = 110;
374 return sys_bind(fd, addr, addrlen);
377 asmlinkage long sys_oabi_connect(int fd, struct sockaddr __user *addr, int addrlen)
379 sa_family_t sa_family;
380 if (addrlen == 112 &&
381 get_user(sa_family, &addr->sa_family) == 0 &&
382 sa_family == AF_UNIX)
383 addrlen = 110;
384 return sys_connect(fd, addr, addrlen);
387 asmlinkage long sys_oabi_sendto(int fd, void __user *buff,
388 size_t len, unsigned flags,
389 struct sockaddr __user *addr,
390 int addrlen)
392 sa_family_t sa_family;
393 if (addrlen == 112 &&
394 get_user(sa_family, &addr->sa_family) == 0 &&
395 sa_family == AF_UNIX)
396 addrlen = 110;
397 return sys_sendto(fd, buff, len, flags, addr, addrlen);
400 asmlinkage long sys_oabi_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
402 struct sockaddr __user *addr;
403 int msg_namelen;
404 sa_family_t sa_family;
405 if (msg &&
406 get_user(msg_namelen, &msg->msg_namelen) == 0 &&
407 msg_namelen == 112 &&
408 get_user(addr, &msg->msg_name) == 0 &&
409 get_user(sa_family, &addr->sa_family) == 0 &&
410 sa_family == AF_UNIX)
413 * HACK ALERT: there is a limit to how much backward bending
414 * we should do for what is actually a transitional
415 * compatibility layer. This already has known flaws with
416 * a few ioctls that we don't intend to fix. Therefore
417 * consider this blatent hack as another one... and take care
418 * to run for cover. In most cases it will "just work fine".
419 * If it doesn't, well, tough.
421 put_user(110, &msg->msg_namelen);
423 return sys_sendmsg(fd, msg, flags);
426 asmlinkage long sys_oabi_socketcall(int call, unsigned long __user *args)
428 unsigned long r = -EFAULT, a[6];
430 switch (call) {
431 case SYS_BIND:
432 if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
433 r = sys_oabi_bind(a[0], (struct sockaddr __user *)a[1], a[2]);
434 break;
435 case SYS_CONNECT:
436 if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
437 r = sys_oabi_connect(a[0], (struct sockaddr __user *)a[1], a[2]);
438 break;
439 case SYS_SENDTO:
440 if (copy_from_user(a, args, 6 * sizeof(long)) == 0)
441 r = sys_oabi_sendto(a[0], (void __user *)a[1], a[2], a[3],
442 (struct sockaddr __user *)a[4], a[5]);
443 break;
444 case SYS_SENDMSG:
445 if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
446 r = sys_oabi_sendmsg(a[0], (struct msghdr __user *)a[1], a[2]);
447 break;
448 default:
449 r = sys_socketcall(call, args);
452 return r;