|
 |
a2d0f5 |
From 3a68f90c2a5a208b475cc2014f85ae04541ec5b6 Mon Sep 17 00:00:00 2001
|
|
|
a2d0f5 |
From: Eugene Syromyatnikov <evgsyr@gmail.com>
|
|
|
a2d0f5 |
Date: Fri, 20 Aug 2021 21:31:01 +0200
|
|
|
a2d0f5 |
Subject: [PATCH 150/150] tee: rewrite num_params access in tee_fetch_buf_data
|
|
|
a2d0f5 |
|
|
|
a2d0f5 |
Pointer to num_params field of the fetched structure is passed in a
|
|
|
a2d0f5 |
separate function argument which provokes covscan complaints about
|
|
|
a2d0f5 |
uninitialised accesses and also tingles my aliasing rules senses.
|
|
|
a2d0f5 |
Rewrite to access it via the arg_struct argument which is fetched
|
|
|
a2d0f5 |
earlier in the function flow.
|
|
|
a2d0f5 |
|
|
|
a2d0f5 |
* src/tee.c (TEE_FETCH_BUF_DATA): Change &arg_.num_params
|
|
|
a2d0f5 |
to offsetof(typeof(arg_), num_params).
|
|
|
a2d0f5 |
(tee_fetch_buf_data): Accept offset of the num_params field instead
|
|
|
a2d0f5 |
of pointer to it; reconstruct the num_params pointer using it.
|
|
|
a2d0f5 |
---
|
|
|
a2d0f5 |
src/tee.c | 5 +++--
|
|
|
a2d0f5 |
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
a2d0f5 |
|
|
|
a2d0f5 |
diff --git a/src/tee.c b/src/tee.c
|
|
|
a2d0f5 |
index f9eda52..d7e9b15 100644
|
|
|
a2d0f5 |
--- a/src/tee.c
|
|
|
a2d0f5 |
+++ b/src/tee.c
|
|
|
a2d0f5 |
@@ -33,7 +33,7 @@ struct tee_ioctl_shm_register_fd_data {
|
|
|
a2d0f5 |
|
|
|
a2d0f5 |
#define TEE_FETCH_BUF_DATA(buf_, arg_, params_) \
|
|
|
a2d0f5 |
tee_fetch_buf_data(tcp, arg, &buf_, sizeof(arg_), \
|
|
|
a2d0f5 |
- &arg_, &arg_.num_params, \
|
|
|
a2d0f5 |
+ &arg_, offsetof(typeof(arg_), num_params), \
|
|
|
a2d0f5 |
params_)
|
|
|
a2d0f5 |
|
|
|
a2d0f5 |
/* session id is printed as 0x%x in libteec */
|
|
|
a2d0f5 |
@@ -56,7 +56,7 @@ tee_fetch_buf_data(struct tcb *const tcp,
|
|
|
a2d0f5 |
struct tee_ioctl_buf_data *buf,
|
|
|
a2d0f5 |
size_t arg_size,
|
|
|
a2d0f5 |
void *arg_struct,
|
|
|
a2d0f5 |
- unsigned *num_params,
|
|
|
a2d0f5 |
+ size_t num_params_offs,
|
|
|
a2d0f5 |
uint64_t *params)
|
|
|
a2d0f5 |
{
|
|
|
a2d0f5 |
if (umove_or_printaddr(tcp, arg, buf))
|
|
|
a2d0f5 |
@@ -69,6 +69,7 @@ tee_fetch_buf_data(struct tcb *const tcp,
|
|
|
a2d0f5 |
tee_print_buf(buf);
|
|
|
a2d0f5 |
return RVAL_IOCTL_DECODED;
|
|
|
a2d0f5 |
}
|
|
|
a2d0f5 |
+ uint32_t *num_params = (uint32_t *) (arg_struct + num_params_offs);
|
|
|
a2d0f5 |
if (entering(tcp) &&
|
|
|
a2d0f5 |
(arg_size + TEE_IOCTL_PARAM_SIZE(*num_params) != buf->buf_len)) {
|
|
|
a2d0f5 |
/*
|
|
|
a2d0f5 |
--
|
|
|
a2d0f5 |
2.1.4
|
|
|
a2d0f5 |
|