aboutsummaryrefslogtreecommitdiffstats
path: root/ipc
diff options
context:
space:
mode:
authorWill Deacon <will.deacon@arm.com>2012-07-30 17:42:43 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2012-07-30 20:25:21 -0400
commit05ba3f1aa1b04e921068249dd52a80bc84c2aeb4 (patch)
tree1176cbea1c1272e7f9567d8f2e71c56510f6efcf /ipc
parentb610c04c667f3c056243fd64041c7f152a512ee4 (diff)
ipc: compat: use signed size_t types for msgsnd and msgrcv
The msgsnd and msgrcv system calls use size_t to represent the size of the message being transferred. POSIX states that values of msgsz greater than SSIZE_MAX cause the result to be implementation-defined. On Linux, this equates to returning -EINVAL if (long) msgsz < 0. For compat tasks where !CONFIG_ARCH_WANT_OLD_COMPAT_IPC and compat_size_t is smaller than size_t, negative size values passed from userspace will be interpreted as positive values by do_msg{rcv,snd} and will fail to exit early with -EINVAL. This patch changes the compat prototypes for msg{rcv,snd} so that the message size is represented as a compat_ssize_t, which we cast to the native ssize_t type for the core IPC code. Cc: Arnd Bergmann <arnd@arndb.de> Acked-by: Chris Metcalf <cmetcalf@tilera.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc')
-rw-r--r--ipc/compat.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/ipc/compat.c b/ipc/compat.c
index a41600f6ba52..20f92b2f2932 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -373,21 +373,21 @@ long compat_sys_semctl(int semid, int semnum, int cmd, int arg)
373} 373}
374 374
375long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp, 375long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
376 size_t msgsz, int msgflg) 376 compat_ssize_t msgsz, int msgflg)
377{ 377{
378 compat_long_t mtype; 378 compat_long_t mtype;
379 379
380 if (get_user(mtype, &msgp->mtype)) 380 if (get_user(mtype, &msgp->mtype))
381 return -EFAULT; 381 return -EFAULT;
382 return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg); 382 return do_msgsnd(msqid, mtype, msgp->mtext, (ssize_t)msgsz, msgflg);
383} 383}
384 384
385long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp, 385long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
386 size_t msgsz, long msgtyp, int msgflg) 386 compat_ssize_t msgsz, long msgtyp, int msgflg)
387{ 387{
388 long err, mtype; 388 long err, mtype;
389 389
390 err = do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg); 390 err = do_msgrcv(msqid, &mtype, msgp->mtext, (ssize_t)msgsz, msgtyp, msgflg);
391 if (err < 0) 391 if (err < 0)
392 goto out; 392 goto out;
393 393