From patchwork Thu Jun 16 19:01:36 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Laurent Vivier X-Patchwork-Id: 9181503 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D873260573 for ; Thu, 16 Jun 2016 19:05:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B284F2837E for ; Thu, 16 Jun 2016 19:05:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 93AF928382; Thu, 16 Jun 2016 19:05:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 097712837E for ; Thu, 16 Jun 2016 19:05:27 +0000 (UTC) Received: from localhost ([::1]:51685 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bDcbW-0005ar-Sl for patchwork-qemu-devel@patchwork.kernel.org; Thu, 16 Jun 2016 15:05:26 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37241) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bDcYD-0002cw-O9 for qemu-devel@nongnu.org; Thu, 16 Jun 2016 15:02:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bDcY6-0006iD-IM for qemu-devel@nongnu.org; Thu, 16 Jun 2016 15:02:00 -0400 Received: from mout.kundenserver.de ([212.227.126.131]:65398) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bDcY6-0006i7-7C for qemu-devel@nongnu.org; Thu, 16 Jun 2016 15:01:54 -0400 Received: from Quad.localdomain ([78.238.229.36]) by mrelayeu.kundenserver.de (mreue001) with ESMTPSA (Nemesis) id 0LaOJ5-1bgsAH0qit-00mImJ; Thu, 16 Jun 2016 21:01:46 +0200 From: Laurent Vivier To: Riku Voipio Date: Thu, 16 Jun 2016 21:01:36 +0200 Message-Id: <1466103697-27279-2-git-send-email-laurent@vivier.eu> X-Mailer: git-send-email 2.5.5 In-Reply-To: <1466103697-27279-1-git-send-email-laurent@vivier.eu> References: <1466103697-27279-1-git-send-email-laurent@vivier.eu> X-Provags-ID: V03:K0:KANWRg+I13jhfP7vzDz/f0E8B/hvShS+fCvYDV+26tnGMHQ39Cf FLx2gcZBwgb0PoMtB8JtKDHllBlej9f1ZuQRY2tb4CXWIrIUeYn+6zzTFmneG21SIKxz8NO VVNfVW/imLIjrEfkvtOIItl5TGSGwvHWoyvHPEcdCW04o3iTf/8QUg085AOyHt3inFGGRdk WMK/17u1rnV9xGPpLd8KA== X-UI-Out-Filterresults: notjunk:1; V01:K0:L7FKq7E+/KE=:+Gkgh2KO8qZYkrW9NzMhu/ eKmv6WUocS/LGFsV4yFChCOdWx4PGjIsslX5rcevflY/aiapKp7jyJ4qXX3ogcM9rjDKRYKro u1jBRytcY+CNDsOZ97x/vKBX04pIZmOjDZZI/gyF/tJhBsxtFVbJzaZPrAsRGwF5XmrX8lmJD tfgMvKv/6FhIWwipuLUZDl0FTJdsyOZtcYAQPD0eaG6+YdM9vt/pnE7TdLMWFZK3hpWSHJs9N uSIwLCJ4mxnlyL7hDJZ2RNiI5hBcF1XQ5mCj+hChxvg9PTnYWv2M69S31jvbWng390x3EchZC 0yqGBX85VheZLzwrNIyYrFvTpzs8hZ76ynhq1PQu4sSfFpJIgJES/kWroHqmCXizNxcP/3xvA OZ3J+e8CddTcnf6RLpDYSZDyN40ev57XT97jG2u4eaYmm1PXqRSRx6W3nA9sQypMkpd2/MhD9 ZgL02/Qpfy4o9JgA1+lxK5zvE0UKM2QbT2ZDL+HXfJ3c4cbbRQh5P5K1WN+c9kiaIDsu8MWGI 9wY/DKfHYPexJmFnbJ5P71p8lzNLbnF3gVSgrAhyM4TNt+nnm+KpO7QYV8MvA2tbWTjW/D/Oh SVGz1DY1R6inVxTIm43Xs4NSjTAQj96pdabkFJ+LEtmNw/2p0pD9HqRExsvJ5QoYiO+atB5qw QGOh/XrFrnCtMFCZX62JLo4e5gkERqJwmw0e2JZbLgdE/yBC3+5xvqoE/vYolSyrX6TA= X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 212.227.126.131 Subject: [Qemu-devel] [PATCH 1/2] linux-user: fd_trans_host_to_target_data() must process only received data X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-devel@nongnu.org, Laurent Vivier Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP if we process the whole buffer, the netlink helpers can try to swap invalid data. Signed-off-by: Laurent Vivier Reviewed-by: Peter Maydell --- linux-user/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 0b937ca..3c30437 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2987,7 +2987,7 @@ static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp, len = ret; if (fd_trans_host_to_target_data(fd)) { ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base, - msg.msg_iov->iov_len); + len); } else { ret = host_to_target_cmsg(msgp, &msg); }