diff options
author | Will Deacon <will.deacon@arm.com> | 2012-07-30 17:42:43 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-07-30 20:25:21 -0400 |
commit | 05ba3f1aa1b04e921068249dd52a80bc84c2aeb4 (patch) | |
tree | 1176cbea1c1272e7f9567d8f2e71c56510f6efcf /ipc | |
parent | b610c04c667f3c056243fd64041c7f152a512ee4 (diff) |
ipc: compat: use signed size_t types for msgsnd and msgrcv
The msgsnd and msgrcv system calls use size_t to represent the size of the
message being transferred. POSIX states that values of msgsz greater than
SSIZE_MAX cause the result to be implementation-defined. On Linux, this
equates to returning -EINVAL if (long) msgsz < 0.
For compat tasks where !CONFIG_ARCH_WANT_OLD_COMPAT_IPC and compat_size_t
is smaller than size_t, negative size values passed from userspace will be
interpreted as positive values by do_msg{rcv,snd} and will fail to exit
early with -EINVAL.
This patch changes the compat prototypes for msg{rcv,snd} so that the
message size is represented as a compat_ssize_t, which we cast to the
native ssize_t type for the core IPC code.
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Chris Metcalf <cmetcalf@tilera.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc')
-rw-r--r-- | ipc/compat.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/ipc/compat.c b/ipc/compat.c index a41600f6ba52..20f92b2f2932 100644 --- a/ipc/compat.c +++ b/ipc/compat.c | |||
@@ -373,21 +373,21 @@ long compat_sys_semctl(int semid, int semnum, int cmd, int arg) | |||
373 | } | 373 | } |
374 | 374 | ||
375 | long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp, | 375 | long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp, |
376 | size_t msgsz, int msgflg) | 376 | compat_ssize_t msgsz, int msgflg) |
377 | { | 377 | { |
378 | compat_long_t mtype; | 378 | compat_long_t mtype; |
379 | 379 | ||
380 | if (get_user(mtype, &msgp->mtype)) | 380 | if (get_user(mtype, &msgp->mtype)) |
381 | return -EFAULT; | 381 | return -EFAULT; |
382 | return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg); | 382 | return do_msgsnd(msqid, mtype, msgp->mtext, (ssize_t)msgsz, msgflg); |
383 | } | 383 | } |
384 | 384 | ||
385 | long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp, | 385 | long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp, |
386 | size_t msgsz, long msgtyp, int msgflg) | 386 | compat_ssize_t msgsz, long msgtyp, int msgflg) |
387 | { | 387 | { |
388 | long err, mtype; | 388 | long err, mtype; |
389 | 389 | ||
390 | err = do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg); | 390 | err = do_msgrcv(msqid, &mtype, msgp->mtext, (ssize_t)msgsz, msgtyp, msgflg); |
391 | if (err < 0) | 391 | if (err < 0) |
392 | goto out; | 392 | goto out; |
393 | 393 | ||