53 lines
1.8 KiB
Diff
53 lines
1.8 KiB
Diff
From 3a68f90c2a5a208b475cc2014f85ae04541ec5b6 Mon Sep 17 00:00:00 2001
|
|
From: Eugene Syromyatnikov <evgsyr@gmail.com>
|
|
Date: Fri, 20 Aug 2021 21:31:01 +0200
|
|
Subject: [PATCH 150/150] tee: rewrite num_params access in tee_fetch_buf_data
|
|
|
|
Pointer to num_params field of the fetched structure is passed in a
|
|
separate function argument which provokes covscan complaints about
|
|
uninitialised accesses and also tingles my aliasing rules senses.
|
|
Rewrite to access it via the arg_struct argument which is fetched
|
|
earlier in the function flow.
|
|
|
|
* src/tee.c (TEE_FETCH_BUF_DATA): Change &arg_.num_params
|
|
to offsetof(typeof(arg_), num_params).
|
|
(tee_fetch_buf_data): Accept offset of the num_params field instead
|
|
of pointer to it; reconstruct the num_params pointer using it.
|
|
---
|
|
src/tee.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/tee.c b/src/tee.c
|
|
index f9eda52..d7e9b15 100644
|
|
--- a/src/tee.c
|
|
+++ b/src/tee.c
|
|
@@ -33,7 +33,7 @@ struct tee_ioctl_shm_register_fd_data {
|
|
|
|
#define TEE_FETCH_BUF_DATA(buf_, arg_, params_) \
|
|
tee_fetch_buf_data(tcp, arg, &buf_, sizeof(arg_), \
|
|
- &arg_, &arg_.num_params, \
|
|
+ &arg_, offsetof(typeof(arg_), num_params), \
|
|
params_)
|
|
|
|
/* session id is printed as 0x%x in libteec */
|
|
@@ -56,7 +56,7 @@ tee_fetch_buf_data(struct tcb *const tcp,
|
|
struct tee_ioctl_buf_data *buf,
|
|
size_t arg_size,
|
|
void *arg_struct,
|
|
- unsigned *num_params,
|
|
+ size_t num_params_offs,
|
|
uint64_t *params)
|
|
{
|
|
if (umove_or_printaddr(tcp, arg, buf))
|
|
@@ -69,6 +69,7 @@ tee_fetch_buf_data(struct tcb *const tcp,
|
|
tee_print_buf(buf);
|
|
return RVAL_IOCTL_DECODED;
|
|
}
|
|
+ uint32_t *num_params = (uint32_t *) (arg_struct + num_params_offs);
|
|
if (entering(tcp) &&
|
|
(arg_size + TEE_IOCTL_PARAM_SIZE(*num_params) != buf->buf_len)) {
|
|
/*
|
|
--
|
|
2.1.4
|
|
|