diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2016-07-04 17:06:18 +0100 |
|---|---|---|
| committer | Riku Voipio <riku.voipio@linaro.org> | 2016-07-19 15:23:16 +0300 |
| commit | a4a2c51f9006b9e6ee3b94f5ce87aed066f3446a (patch) | |
| tree | 48547a32df4ec3c468509d7108ad28074f609c0e | |
| parent | 884cdc48a98fca7d758a5934af526cd1fcedcc9e (diff) | |
linux-user: Correct type for BLKSSZGET
The BLKSSZGET ioctl takes an argument which is a pointer to an int.
We were incorrectly declaring it to take a pointer to a long, which
meant that we would incorrectly write to memory which we should not
if the guest is a 64-bit architecture.
In particular, kpartx uses this ioctl to write to an int on the
stack, which tends to result in it crashing immediately.
Reported-by: Chanho Park <chanho61.park@samsung.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
| -rw-r--r-- | linux-user/ioctls.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h index abff6b6e7d..a066d9b3f6 100644 --- a/linux-user/ioctls.h +++ b/linux-user/ioctls.h @@ -76,7 +76,7 @@ IOCTL(BLKFLSBUF, 0, TYPE_NULL) IOCTL(BLKRASET, 0, TYPE_INT) IOCTL(BLKRAGET, IOC_R, MK_PTR(TYPE_LONG)) - IOCTL(BLKSSZGET, IOC_R, MK_PTR(TYPE_LONG)) + IOCTL(BLKSSZGET, IOC_R, MK_PTR(TYPE_INT)) IOCTL(BLKBSZGET, IOC_R, MK_PTR(TYPE_INT)) IOCTL_SPECIAL(BLKPG, IOC_W, do_ioctl_blkpg, MK_PTR(MK_STRUCT(STRUCT_blkpg_ioctl_arg))) |