提交 6673e0c3 编写于 作者: H Heiko Carstens

[CVE-2009-0029] System call wrapper special cases

System calls with an unsigned long long argument can't be converted with
the standard wrappers since that would include a cast to long, which in
turn means that we would lose the upper 32 bit on 32 bit architectures.
Also semctl can't use the standard wrapper since it has a 'union'
parameter.

So we handle them as special case and add some extra wrappers instead.
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
上级 ed6bb619
...@@ -145,7 +145,7 @@ int get_dcookie(struct path *path, unsigned long *cookie) ...@@ -145,7 +145,7 @@ int get_dcookie(struct path *path, unsigned long *cookie)
/* And here is where the userspace process can look up the cookie value /* And here is where the userspace process can look up the cookie value
* to retrieve the path. * to retrieve the path.
*/ */
asmlinkage long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len) SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
{ {
unsigned long cookie = (unsigned long)cookie64; unsigned long cookie = (unsigned long)cookie64;
int err = -EINVAL; int err = -EINVAL;
...@@ -198,7 +198,13 @@ asmlinkage long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len) ...@@ -198,7 +198,13 @@ asmlinkage long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
mutex_unlock(&dcookie_mutex); mutex_unlock(&dcookie_mutex);
return err; return err;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_lookup_dcookie(u64 cookie64, long buf, long len)
{
return SYSC_lookup_dcookie(cookie64, (char __user *) buf, (size_t) len);
}
SYSCALL_ALIAS(sys_lookup_dcookie, SyS_lookup_dcookie);
#endif
static int dcookie_init(void) static int dcookie_init(void)
{ {
......
...@@ -351,21 +351,35 @@ asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length) ...@@ -351,21 +351,35 @@ asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
/* LFS versions of truncate are only needed on 32 bit machines */ /* LFS versions of truncate are only needed on 32 bit machines */
#if BITS_PER_LONG == 32 #if BITS_PER_LONG == 32
asmlinkage long sys_truncate64(const char __user * path, loff_t length) SYSCALL_DEFINE(truncate64)(const char __user * path, loff_t length)
{ {
return do_sys_truncate(path, length); return do_sys_truncate(path, length);
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_truncate64(long path, loff_t length)
{
return SYSC_truncate64((const char __user *) path, length);
}
SYSCALL_ALIAS(sys_truncate64, SyS_truncate64);
#endif
asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length) SYSCALL_DEFINE(ftruncate64)(unsigned int fd, loff_t length)
{ {
long ret = do_sys_ftruncate(fd, length, 0); long ret = do_sys_ftruncate(fd, length, 0);
/* avoid REGPARM breakage on x86: */ /* avoid REGPARM breakage on x86: */
asmlinkage_protect(2, ret, fd, length); asmlinkage_protect(2, ret, fd, length);
return ret; return ret;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_ftruncate64(long fd, loff_t length)
{
return SYSC_ftruncate64((unsigned int) fd, length);
}
SYSCALL_ALIAS(sys_ftruncate64, SyS_ftruncate64);
#endif #endif
#endif /* BITS_PER_LONG == 32 */
asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len) SYSCALL_DEFINE(fallocate)(int fd, int mode, loff_t offset, loff_t len)
{ {
struct file *file; struct file *file;
struct inode *inode; struct inode *inode;
...@@ -422,6 +436,13 @@ asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len) ...@@ -422,6 +436,13 @@ asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len)
out: out:
return ret; return ret;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_fallocate(long fd, long mode, loff_t offset, loff_t len)
{
return SYSC_fallocate((int)fd, (int)mode, offset, len);
}
SYSCALL_ALIAS(sys_fallocate, SyS_fallocate);
#endif
/* /*
* access() needs to use the real uid/gid, not the effective uid/gid. * access() needs to use the real uid/gid, not the effective uid/gid.
......
...@@ -403,8 +403,8 @@ asmlinkage long sys_write(unsigned int fd, const char __user * buf, size_t count ...@@ -403,8 +403,8 @@ asmlinkage long sys_write(unsigned int fd, const char __user * buf, size_t count
return ret; return ret;
} }
asmlinkage long sys_pread64(unsigned int fd, char __user *buf, SYSCALL_DEFINE(pread64)(unsigned int fd, char __user *buf,
size_t count, loff_t pos) size_t count, loff_t pos)
{ {
struct file *file; struct file *file;
ssize_t ret = -EBADF; ssize_t ret = -EBADF;
...@@ -423,9 +423,17 @@ asmlinkage long sys_pread64(unsigned int fd, char __user *buf, ...@@ -423,9 +423,17 @@ asmlinkage long sys_pread64(unsigned int fd, char __user *buf,
return ret; return ret;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_pread64(long fd, long buf, long count, loff_t pos)
{
return SYSC_pread64((unsigned int) fd, (char __user *) buf,
(size_t) count, pos);
}
SYSCALL_ALIAS(sys_pread64, SyS_pread64);
#endif
asmlinkage long sys_pwrite64(unsigned int fd, const char __user *buf, SYSCALL_DEFINE(pwrite64)(unsigned int fd, const char __user *buf,
size_t count, loff_t pos) size_t count, loff_t pos)
{ {
struct file *file; struct file *file;
ssize_t ret = -EBADF; ssize_t ret = -EBADF;
...@@ -444,6 +452,14 @@ asmlinkage long sys_pwrite64(unsigned int fd, const char __user *buf, ...@@ -444,6 +452,14 @@ asmlinkage long sys_pwrite64(unsigned int fd, const char __user *buf,
return ret; return ret;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_pwrite64(long fd, long buf, long count, loff_t pos)
{
return SYSC_pwrite64((unsigned int) fd, (const char __user *) buf,
(size_t) count, pos);
}
SYSCALL_ALIAS(sys_pwrite64, SyS_pwrite64);
#endif
/* /*
* Reduce an iovec's length in-place. Return the resulting number of segments * Reduce an iovec's length in-place. Return the resulting number of segments
......
...@@ -201,8 +201,8 @@ asmlinkage long sys_fdatasync(unsigned int fd) ...@@ -201,8 +201,8 @@ asmlinkage long sys_fdatasync(unsigned int fd)
* already-instantiated disk blocks, there are no guarantees here that the data * already-instantiated disk blocks, there are no guarantees here that the data
* will be available after a crash. * will be available after a crash.
*/ */
asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes, SYSCALL_DEFINE(sync_file_range)(int fd, loff_t offset, loff_t nbytes,
unsigned int flags) unsigned int flags)
{ {
int ret; int ret;
struct file *file; struct file *file;
...@@ -262,14 +262,32 @@ asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes, ...@@ -262,14 +262,32 @@ asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
out: out:
return ret; return ret;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_sync_file_range(long fd, loff_t offset, loff_t nbytes,
long flags)
{
return SYSC_sync_file_range((int) fd, offset, nbytes,
(unsigned int) flags);
}
SYSCALL_ALIAS(sys_sync_file_range, SyS_sync_file_range);
#endif
/* It would be nice if people remember that not all the world's an i386 /* It would be nice if people remember that not all the world's an i386
when they introduce new system calls */ when they introduce new system calls */
asmlinkage long sys_sync_file_range2(int fd, unsigned int flags, SYSCALL_DEFINE(sync_file_range2)(int fd, unsigned int flags,
loff_t offset, loff_t nbytes) loff_t offset, loff_t nbytes)
{ {
return sys_sync_file_range(fd, offset, nbytes, flags); return sys_sync_file_range(fd, offset, nbytes, flags);
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_sync_file_range2(long fd, long flags,
loff_t offset, loff_t nbytes)
{
return SYSC_sync_file_range2((int) fd, (unsigned int) flags,
offset, nbytes);
}
SYSCALL_ALIAS(sys_sync_file_range2, SyS_sync_file_range2);
#endif
/* /*
* `endbyte' is inclusive * `endbyte' is inclusive
......
...@@ -887,7 +887,7 @@ static int semctl_down(struct ipc_namespace *ns, int semid, ...@@ -887,7 +887,7 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
return err; return err;
} }
asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg) SYSCALL_DEFINE(semctl)(int semid, int semnum, int cmd, union semun arg)
{ {
int err = -EINVAL; int err = -EINVAL;
int version; int version;
...@@ -923,6 +923,13 @@ asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg) ...@@ -923,6 +923,13 @@ asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg)
return -EINVAL; return -EINVAL;
} }
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_semctl(int semid, int semnum, int cmd, union semun arg)
{
return SYSC_semctl((int) semid, (int) semnum, (int) cmd, arg);
}
SYSCALL_ALIAS(sys_semctl, SyS_semctl);
#endif
/* If the task doesn't already have a undo_list, then allocate one /* If the task doesn't already have a undo_list, then allocate one
* here. We guarantee there is only one thread using this undo list, * here. We guarantee there is only one thread using this undo list,
......
...@@ -24,7 +24,7 @@ ...@@ -24,7 +24,7 @@
* POSIX_FADV_WILLNEED could set PG_Referenced, and POSIX_FADV_NOREUSE could * POSIX_FADV_WILLNEED could set PG_Referenced, and POSIX_FADV_NOREUSE could
* deactivate the pages and clear PG_Referenced. * deactivate the pages and clear PG_Referenced.
*/ */
asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice) SYSCALL_DEFINE(fadvise64_64)(int fd, loff_t offset, loff_t len, int advice)
{ {
struct file *file = fget(fd); struct file *file = fget(fd);
struct address_space *mapping; struct address_space *mapping;
...@@ -126,12 +126,26 @@ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice) ...@@ -126,12 +126,26 @@ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
fput(file); fput(file);
return ret; return ret;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_fadvise64_64(long fd, loff_t offset, loff_t len, long advice)
{
return SYSC_fadvise64_64((int) fd, offset, len, (int) advice);
}
SYSCALL_ALIAS(sys_fadvise64_64, SyS_fadvise64_64);
#endif
#ifdef __ARCH_WANT_SYS_FADVISE64 #ifdef __ARCH_WANT_SYS_FADVISE64
asmlinkage long sys_fadvise64(int fd, loff_t offset, size_t len, int advice) SYSCALL_DEFINE(fadvise64)(int fd, loff_t offset, size_t len, int advice)
{ {
return sys_fadvise64_64(fd, offset, len, advice); return sys_fadvise64_64(fd, offset, len, advice);
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_fadvise64(long fd, loff_t offset, long len, long advice)
{
return SYSC_fadvise64((int) fd, offset, (size_t)len, (int)advice);
}
SYSCALL_ALIAS(sys_fadvise64, SyS_fadvise64);
#endif
#endif #endif
...@@ -1374,7 +1374,7 @@ do_readahead(struct address_space *mapping, struct file *filp, ...@@ -1374,7 +1374,7 @@ do_readahead(struct address_space *mapping, struct file *filp,
return 0; return 0;
} }
asmlinkage long sys_readahead(int fd, loff_t offset, size_t count) SYSCALL_DEFINE(readahead)(int fd, loff_t offset, size_t count)
{ {
ssize_t ret; ssize_t ret;
struct file *file; struct file *file;
...@@ -1393,6 +1393,13 @@ asmlinkage long sys_readahead(int fd, loff_t offset, size_t count) ...@@ -1393,6 +1393,13 @@ asmlinkage long sys_readahead(int fd, loff_t offset, size_t count)
} }
return ret; return ret;
} }
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
asmlinkage long SyS_readahead(long fd, loff_t offset, long count)
{
return SYSC_readahead((int) fd, offset, (size_t) count);
}
SYSCALL_ALIAS(sys_readahead, SyS_readahead);
#endif
#ifdef CONFIG_MMU #ifdef CONFIG_MMU
/** /**
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册