Re: [PATCH] ioctl_list.2: BLKRASET/BLKRAGET take unsigned long
From: Michael Kerrisk (man-pages) <hidden>
Date: 2017-04-10 15:21:14
Also in:
linux-man
On 02/15/2017 12:20 PM, Cyril Hrubis wrote:
The BLKRASET/BLKRAGET ioctls() take unsigned long, if I pass int * to the BLKRAGET ioctl on x86_64 (or on any other arch where sizeof(int) != sizeof(long)) the BLKRAGET ioctl will rewrite four bytes on the stack. If you look at block/ioctl.c in kernel sources you can clearly see that BLKRAGET ioctl calls put_long(). Compile following reproducer and run it as ./a.out /dev/sda, you can see that the second member of the array will be zeroed. If you change the array to have only one member you will see stack smashing trace. I also wonder if it's OK to pass int value to ioctl() at all, the arg value seems to be unsigned long in the syscall definition in fs/ioctl.c and there does not seem to be any glibc magic around the syscall.
Thanks Cyril. Applied now. Sorry for the delayed response... Cheers, Michael
quoted hunk
-------------------------8<---------------------------- #include <sys/mount.h> #include <sys/ioctl.h> #include <fcntl.h> #include <stdio.h> static int fd; int main(int argc, char *argv[]) { int ra[] = {100, 100}; fd = open(argv[1], O_RDONLY); if (fd < 0) { perror("open"); return 1; } ioctl(fd, BLKRAGET, ra); fprintf(stderr, "%i %i\n", ra[0], ra[1]); return 0; } -------------------------8<---------------------------- Signed-off-by: Cyril Hrubis <redacted> --- man2/ioctl_list.2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/man2/ioctl_list.2 b/man2/ioctl_list.2 index 0165c77..c8efd66 100644 --- a/man2/ioctl_list.2 +++ b/man2/ioctl_list.2@@ -311,8 +311,8 @@ l l l l. 0x0000125F BLKRRPART void 0x00001260 BLKGETSIZE unsigned long * 0x00001261 BLKFLSBUF void -0x00001262 BLKRASET int -0x00001263 BLKRAGET int * +0x00001262 BLKRASET unsigned long +0x00001263 BLKRAGET unsigned long * 0x00000001 FIBMAP int * // I-O 0x00000002 FIGETBSZ int * 0x80086601 FS_IOC_GETFLAGS int *
-- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/