diff options
author | Wesley W. Terpstra <terpstra@debian.org> | 2011-07-12 14:38:22 +0300 |
---|---|---|
committer | Riku Voipio <riku.voipio@linaro.org> | 2011-07-12 14:38:22 +0300 |
commit | 95b33b2f4f0293068d1a42b3ab5badcc6333c6ba (patch) | |
tree | 3f4ef76d5a8b48ef6f0997ec826d92d92918232b /linux-user | |
parent | e6e5bd2dd1868b5a244bc572422f585cef579ffb (diff) | |
download | qemu-95b33b2f4f0293068d1a42b3ab5badcc6333c6ba.zip qemu-95b33b2f4f0293068d1a42b3ab5badcc6333c6ba.tar.gz qemu-95b33b2f4f0293068d1a42b3ab5badcc6333c6ba.tar.bz2 |
mips: rlimit incorrectly converts values
Byte swap was applied in the wrong order with testing for
RLIM_INFINITY. On mips bigendian from an amd64 system this results in
infinity being misinterpretted as 2^31-1.
This is a serious bug because it causes setrlimit stack size to kill
all child processes. This means (for example) that 'make' can run no
children. The mechanism of failure:
1. parent sets stack size rlimit to 'infinity'
2. qemu screws this value up
3. child process fetches stack size as a large (but non-infinite) value
4. qemu tries to allocate stack before execution
5. stack allocation fails (too big) and child process dies
Signed-off-by: Wesley W. Terpstra <terpstra@debian.org>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
Diffstat (limited to 'linux-user')
-rw-r--r-- | linux-user/syscall.c | 22 |
1 files changed, 17 insertions, 5 deletions
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 90f6789..4b9e3b8 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -934,18 +934,30 @@ static inline abi_long host_to_target_rusage(abi_ulong target_addr, static inline rlim_t target_to_host_rlim(target_ulong target_rlim) { - if (target_rlim == TARGET_RLIM_INFINITY) - return RLIM_INFINITY; + target_ulong target_rlim_swap; + rlim_t result; + + target_rlim_swap = tswapl(target_rlim); + if (target_rlim_swap == TARGET_RLIM_INFINITY || target_rlim_swap != (rlim_t)target_rlim_swap) + result = RLIM_INFINITY; else - return tswapl(target_rlim); + result = target_rlim_swap; + + return result; } static inline target_ulong host_to_target_rlim(rlim_t rlim) { + target_ulong target_rlim_swap; + target_ulong result; + if (rlim == RLIM_INFINITY || rlim != (target_long)rlim) - return TARGET_RLIM_INFINITY; + target_rlim_swap = TARGET_RLIM_INFINITY; else - return tswapl(rlim); + target_rlim_swap = rlim; + result = tswapl(target_rlim_swap); + + return result; } static inline abi_long copy_from_user_timeval(struct timeval *tv, |