From nobody Tue May 13 18:34:10 2025 Delivered-To: importer2@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1677199206; cv=none; d=zohomail.com; s=zohoarc; b=XDC2b3qQYXXQYKtwU6qFqAOJikKlRCcdgpKSKdmyn9ARjxHOLQBgUwhGqjhkevXg1Pi2ztsfeX3FBrezB/x0EjAN4kd4I9i8XxXL857ubhImdCwokXrKMl6QjSEEfONe543zotOAIAh9ZHQ8hLpk5xrWVbwJRIoKzSWCk/gOpaY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1677199206; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=92cZeT0FTkL4A2j2MIC0Ig/JcJc5obb+AuZzdTaUFok=; b=Mp4veXZT+di0MGyOHBO6x1JCGgZ2z/BsHdIkneoUp61nEEWjx0k0gz1teSR2S4EP6j4mPIgZonqDaVSgcGAxEQggMXCBLP2m1J6bn/wgc0RpGNXQYFC5C69nmoeqGC/p8WaOM+VNI8m8RpQCTHFv5qtLpz349b7RgcIgTeDNA5s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1677199206524561.3444131706573; Thu, 23 Feb 2023 16:40:06 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pVM7U-0006pH-3n; Thu, 23 Feb 2023 19:39:28 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pVM7P-0006om-Gb for qemu-devel@nongnu.org; Thu, 23 Feb 2023 19:39:23 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pVM7N-0006Tc-Oq for qemu-devel@nongnu.org; Thu, 23 Feb 2023 19:39:23 -0500 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 31NLPdJa017249; Fri, 24 Feb 2023 00:39:19 GMT Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3nxg23c0f3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 24 Feb 2023 00:39:18 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 31N7rmQT031150; Fri, 24 Feb 2023 00:39:16 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma05fra.de.ibm.com (PPS) with ESMTPS id 3ntpa6dhy8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 24 Feb 2023 00:39:16 +0000 Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 31O0dCHs57016694 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 24 Feb 2023 00:39:13 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C3AD720049; Fri, 24 Feb 2023 00:39:12 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5EACF20043; Fri, 24 Feb 2023 00:39:12 +0000 (GMT) Received: from heavy.boeblingen.de.ibm.com (unknown [9.179.17.238]) by smtpav06.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 24 Feb 2023 00:39:12 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=92cZeT0FTkL4A2j2MIC0Ig/JcJc5obb+AuZzdTaUFok=; b=gHE7y60BzUaz1XJNfH2XyIvZJt/BBaXxEk2SwrBr32crcKFxA67dCzqsGjQ1iBGlHOHq EKRea/2pjDAWNwK++FrMm15U2e46F/8HzaTL4UyEeKWOxw1nmn0fApPx88nyXBJkcMUn 15EiyDmENv0KSDvFDnydRbzXSD2XYUlRa/zKEGUJ2JuHAsMJVOlBRpxiB5FPPX1OV3th /2iyFBqQhleK1Fu4YBSGb+h8rvcDrF96FhxyQj495BDhbOzpzoYyteoNpeUDHUEkCKGf lzgA9kPXK7NKJ3pXVEhUkyFjHQrsMQDjH4L5D/s/JkC4HnmENwJW3vdcFp86oNfm848H Gw== From: Ilya Leoshkevich To: =?UTF-8?q?Alex=20Benn=C3=A9e?= , Laurent Vivier Cc: qemu-devel@nongnu.org, Christian Borntraeger , Ilya Leoshkevich , Richard Henderson Subject: [PATCH v3 1/2] linux-user: Fix unaligned memory access in prlimit64 syscall Date: Fri, 24 Feb 2023 01:39:06 +0100 Message-Id: <20230224003907.263914-2-iii@linux.ibm.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230224003907.263914-1-iii@linux.ibm.com> References: <20230224003907.263914-1-iii@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: KFy-W1R5tLK2RWbSq8dZ-6dOd-Yzsnvu X-Proofpoint-GUID: KFy-W1R5tLK2RWbSq8dZ-6dOd-Yzsnvu X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.170.22 definitions=2023-02-23_14,2023-02-23_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 clxscore=1015 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 impostorscore=0 priorityscore=1501 mlxscore=0 mlxlogscore=999 adultscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2302240003 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer2=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=iii@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer2=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer2=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1677199208378100006 Content-Type: text/plain; charset="utf-8" target_rlimit64 contains uint64_t fields, so it's 8-byte aligned on some hosts, while some guests may align their respective type on a 4-byte boundary. This may lead to an unaligned access, which is an UB. Fix by defining the fields as abi_ullong. This makes the host alignment match that of the guest, and lets the compiler know that it should emit code that can deal with the guest alignment. While at it, also use __get_user() and __put_user() instead of tswap64(). Fixes: 163a05a8398b ("linux-user: Implement prlimit64 syscall") Reported-by: Richard Henderson Signed-off-by: Ilya Leoshkevich Reviewed-by: Laurent Vivier Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- linux-user/generic/target_resource.h | 4 ++-- linux-user/syscall.c | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/linux-user/generic/target_resource.h b/linux-user/generic/targ= et_resource.h index 539d8c46772..37d3eb09b3b 100644 --- a/linux-user/generic/target_resource.h +++ b/linux-user/generic/target_resource.h @@ -12,8 +12,8 @@ struct target_rlimit { }; =20 struct target_rlimit64 { - uint64_t rlim_cur; - uint64_t rlim_max; + abi_ullong rlim_cur; + abi_ullong rlim_max; }; =20 #define TARGET_RLIM_INFINITY ((abi_ulong)-1) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index a6c426d73cf..73082531ffc 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -12886,8 +12886,8 @@ static abi_long do_syscall1(CPUArchState *cpu_env, = int num, abi_long arg1, if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) { return -TARGET_EFAULT; } - rnew.rlim_cur =3D tswap64(target_rnew->rlim_cur); - rnew.rlim_max =3D tswap64(target_rnew->rlim_max); + __get_user(rnew.rlim_cur, &target_rnew->rlim_cur); + __get_user(rnew.rlim_max, &target_rnew->rlim_max); unlock_user_struct(target_rnew, arg3, 0); rnewp =3D &rnew; } @@ -12897,8 +12897,8 @@ static abi_long do_syscall1(CPUArchState *cpu_env, = int num, abi_long arg1, if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) { return -TARGET_EFAULT; } - target_rold->rlim_cur =3D tswap64(rold.rlim_cur); - target_rold->rlim_max =3D tswap64(rold.rlim_max); + __put_user(rold.rlim_cur, &target_rold->rlim_cur); + __put_user(rold.rlim_max, &target_rold->rlim_max); unlock_user_struct(target_rold, arg4, 1); } return ret; --=20 2.39.1