gh0s7/mckernel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flatten_string/process env: realign env and clear trailing bits

Browse Source 
envs are stuck after args which are now possibly unaligned, and used
from a non-aligned pointer in prepare_process_ranges_args_envs (env)

The memory immediately after args/envs is copied anyway with memcpy_long,
so make sure the bits are initialized and realign env correctly

Fixes: 70e52faf36 ("flatten_strings: do not return unused trailing bits")
Change-Id: Ic747e947d151c0eea65dec36bc9c888cf6e0c394
This commit is contained in:
Dominique Martinet
2018-10-16 10:52:39 +09:00
committed by Dominique Martinet
parent 38e68f358a
commit 525b90d028
3 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
kernel/host.c
View File

@@ -75,7 +75,7 @@ int prepare_process_ranges_args_envs(struct thread *thread,
char *envs, int envs_len)
{
char *args_envs, *args_envs_r;
unsigned long args_envs_p, args_envs_rp;
unsigned long args_envs_p, args_envs_rp, envs_offset;
unsigned long s, e, up;
char **argv;
int i, n, argc, envc, args_envs_npages;
@@ -336,7 +336,13 @@ int prepare_process_ranges_args_envs(struct thread *thread,
dkprintf("envs copy, nr: %d\n", *((long *)args_envs_r));
memcpy_long(args_envs + p->args_len, args_envs_r, p->envs_len + sizeof(long) - 1);
/* p->args_len is not necessarily long-aligned, even if the memory
* below exists and is zeroed out - env must start aligned
*/
envs_offset = (p->args_len + sizeof(long) - 1) & ~(sizeof(long) - 1);
memcpy_long(args_envs + envs_offset, args_envs_r,
p->envs_len + sizeof(long) - 1);
/* Only map remote address if it wasn't specified as an argument */
if (!envs) {
@@ -375,12 +381,12 @@ int prepare_process_ranges_args_envs(struct thread *thread,
argv[i] = (char *)addr + (unsigned long)argv[i];
}
envc = *((long *)(args_envs + p->args_len));
envc = *((long *)(args_envs + envs_offset));
dkprintf("envc: %d\n", envc);
env = (char **)(args_envs + p->args_len + sizeof(long));
env = (char **)(args_envs + envs_offset + sizeof(long));
for (i = 0; i < envc; i++) {
env[i] = addr + p->args_len + env[i];
env[i] = addr + envs_offset + env[i];
}
dkprintf("env OK\n");