linux-kernel - Re: Ioctl in 2.6.35.22 change the argument value?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 29 Jun 2011 23:09:26 -0700
From:	孙子荀 <faye.zixun@...il.com>
To:	linux-kernel mlist <linux-kernel@...r.kernel.org>
Cc:	linux-stable mlist <stable@...nel.org>
Subject: Re: Ioctl in 2.6.35.22 change the argument value?

Hello everybody,

When I want to get the block size about the block device(DM or real),I
use the system API like "ioctl(int fd, BLKGETSIZE,long size)".
Everything works fine. But when I pass the third parameter whose type
is "int", the first parameter fd will be changed to zero. It only
happened on x86_64 and 2.6.35 ,on  2.6.38 and 32bit will not occur,
I've already tested on them.
(My PC:Linux server-group 2.6.35-22-server #33-Ubuntu SMP Sun Sep 19
20:48:58 UTC 2010 x86_64 GNU/Linux)
here is the test code:
int main(){
        int fd;
        int blksize ;
        fd = open("/dev/sda",O_RDONLY,0);
        ioctl(fd, BLKGETSIZE,&blksize) ;
        close(fd);
}
If I change the fd type as long( int fd ==> long fd ) , won't occur
again. I quite sure the ioctl syscall when return to userspace changes
the fd's value.
(gdb) r
Starting program: /home/test/main
10              fd = open("/dev/sda",O_RDONLY,0);
(gdb)
   0x00000000004005a7 <+35>:    callq  0x400490 <open@plt>
   0x00000000004005ac <+40>:    mov    %eax,-0x4(%rbp)
   0x00000000004005af <+43>:    lea    -0x8(%rbp),%rdx
   0x00000000004005b3 <+47>:    mov    -0x4(%rbp),%eax
   0x00000000004005b6 <+50>:    mov    $0x1260,%esi
=> 0x00000000004005bb <+55>:    mov    %eax,%edi
   0x00000000004005bd <+57>:    mov    $0x0,%eax
   0x00000000004005c2 <+62>:    callq  0x400470 <ioctl@plt>
   0x00000000004005c7 <+67>:    mov    -0x4(%rbp),%eax
(gdb) ni
0x00000000004005bd      11              ioctl(fd, BLKGETSIZE,&blksize) ;
(gdb) p $edi
$1 = 5
(gdb) n
12              close(fd);
(gdb) p $edi
$3 = 5
(gdb) p fd
$4 = 0
And I also find that in the function :
"int blkdev_ioctl(struct block_device *bdev, fmode_t mode, unsigned
cmd,unsigned long arg)"
If it's case<BLKBSZGET BLKPBSZGET> which  return put_uint() will be
fine ,I mean the fd, and that was opposite to the case<BLKGETSIZE
BLKGETSIZE64> which  return put_long() ;
Dose anybody now which patch after 2.6.35 slove the problem ?I just
guess about restore_all(arch/x86/include/). thanks a lot!
I will be gratefull for u help. Thanks a lot. Thanks a million!
--
Regards,
Sri.
--
2011-06-30

--------------------------------------------------------------------------------

faye.zixun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/