Commit 7b22c035 authored by AKASHI Takahiro's avatar AKASHI Takahiro Committed by Catalin Marinas

arm64: check for number of arguments in syscall_get/set_arguments()

In ftrace_syscall_enter(),
    syscall_get_arguments(..., 0, n, ...)
        if (i == 0) { <handle orig_x0> ...; n--;}
        memcpy(..., n * sizeof(args[0]));
If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in
syscall_get_arguments(), none of arguments should be copied by memcpy().
Otherwise 'n--' can be a big positive number and unexpected amount of data
will be copied. Tracing system calls which take no argument, say sync(void),
may hit this case and eventually make the system corrupted.
This patch fixes the issue both in syscall_get_arguments() and
syscall_set_arguments().
Signed-off-by: default avatarAKASHI Takahiro <takahiro.akashi@linaro.org>
Acked-by: default avatarWill Deacon <will.deacon@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent d0e639c9
...@@ -59,6 +59,9 @@ static inline void syscall_get_arguments(struct task_struct *task, ...@@ -59,6 +59,9 @@ static inline void syscall_get_arguments(struct task_struct *task,
unsigned int i, unsigned int n, unsigned int i, unsigned int n,
unsigned long *args) unsigned long *args)
{ {
if (n == 0)
return;
if (i + n > SYSCALL_MAX_ARGS) { if (i + n > SYSCALL_MAX_ARGS) {
unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i; unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
unsigned int n_bad = n + i - SYSCALL_MAX_ARGS; unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
...@@ -82,6 +85,9 @@ static inline void syscall_set_arguments(struct task_struct *task, ...@@ -82,6 +85,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
unsigned int i, unsigned int n, unsigned int i, unsigned int n,
const unsigned long *args) const unsigned long *args)
{ {
if (n == 0)
return;
if (i + n > SYSCALL_MAX_ARGS) { if (i + n > SYSCALL_MAX_ARGS) {
pr_warning("%s called with max args %d, handling only %d\n", pr_warning("%s called with max args %d, handling only %d\n",
__func__, i + n, SYSCALL_MAX_ARGS); __func__, i + n, SYSCALL_MAX_ARGS);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment