int sys_quotactl(struct tcb *tcp) { /* * The Linux kernel only looks at the low 32 bits of command and id * arguments, but on some 64-bit architectures (s390x) this word * will have been sign-extended when we see it. The high 1 bits * don't mean anything, so don't confuse the output with them. */ u_int32_t qcmd = tcp->u_arg[0]; u_int32_t cmd = QCMD_CMD(qcmd); u_int32_t type = QCMD_TYPE(qcmd); u_int32_t id = tcp->u_arg[2]; if (!verbose(tcp)) return printargs(tcp); if (entering(tcp)) { printxval(quotacmds, cmd, "Q_???"); tprintf("|"); printxval(quotatypes, type, "???QUOTA"); tprintf(", "); printstr(tcp, tcp->u_arg[1], -1); tprintf(", "); switch (cmd) { case Q_V1_QUOTAON: case Q_QUOTAON: printxval(quota_formats, id, "QFMT_VFS_???"); break; case Q_V1_GETQUOTA: case Q_V2_GETQUOTA: case Q_GETQUOTA: case Q_V1_SETQUOTA: case Q_V2_SETQUOTA: case Q_V1_SETUSE: case Q_V2_SETUSE: case Q_SETQLIM: case Q_SETQUOTA: case Q_XGETQUOTA: case Q_XSETQLIM: tprintf("%u", id); break; default: tprintf("%#lx", tcp->u_arg[2]); break; } tprintf(", "); } else { if (!tcp->u_arg[3]) tprintf("NULL"); else decode_cmd_data(tcp, cmd, tcp->u_arg[3]); } return 0; }
int main(void) { char bogus_special_str[sizeof(void *) * 2 + sizeof("0x")]; char bogus_addr_str[sizeof(void *) * 2 + sizeof("0x")]; char unterminated_str[sizeof(void *) * 2 + sizeof("0x")]; long rc; struct fs_disk_quota *xdq = tail_alloc(sizeof(*xdq)); struct fs_quota_stat *xqstat = tail_alloc(sizeof(*xqstat)); struct fs_quota_statv *xqstatv = tail_alloc(sizeof(*xqstatv)); uint32_t *flags = tail_alloc(sizeof(*flags)); char *unterminated = tail_memdup(unterminated_data, sizeof(unterminated_data)); snprintf(bogus_special_str, sizeof(bogus_special_str), "%p", bogus_special); snprintf(bogus_addr_str, sizeof(bogus_addr_str), "%p", bogus_addr); snprintf(unterminated_str, sizeof(unterminated_str), "%p", unterminated); /* Q_XQUOTAON */ *flags = 0xdeadbeef; check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTAON, USRQUOTA)), ARG_STR("/dev/bogus/"), flags, "[XFS_QUOTA_UDQ_ACCT|XFS_QUOTA_UDQ_ENFD" "|XFS_QUOTA_GDQ_ACCT|XFS_QUOTA_GDQ_ENFD" "|XFS_QUOTA_PDQ_ENFD|0xdeadbec0]"); rc = syscall(__NR_quotactl, QCMD(Q_XQUOTAON, 0xfacefeed), bogus_dev, bogus_id, bogus_addr); printf("quotactl(QCMD(Q_XQUOTAON, %#x /* ???QUOTA */)" ", %s, %p) = %s\n", QCMD_TYPE(QCMD(Q_XQUOTAON, 0xfacefeed)), bogus_dev_str, bogus_addr, sprintrc(rc)); /* Q_XQUOTAOFF */ check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTAOFF, USRQUOTA)), bogus_special, bogus_special_str, bogus_addr, bogus_addr_str); check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTAOFF, GRPQUOTA)), ARG_STR("/dev/bogus/"), ARG_STR(NULL)); check_quota(CQF_ID_SKIP | CQF_ADDR_STR, QCMD(Q_XQUOTAOFF, 3), "QCMD(Q_XQUOTAOFF, 0x3 /* ???QUOTA */)", ARG_STR("/dev/bogus/"), flags, "[XFS_QUOTA_UDQ_ACCT|XFS_QUOTA_UDQ_ENFD" "|XFS_QUOTA_GDQ_ACCT|XFS_QUOTA_GDQ_ENFD" "|XFS_QUOTA_PDQ_ENFD|0xdeadbec0]"); /* Q_XGETQUOTA */ /* Trying our best to get successful result */ check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_GETQUOTA, USRQUOTA)), ARG_STR("/dev/sda1"), getuid(), xdq, print_xdisk_quota, (intptr_t) 1); check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_GETQUOTA, GRPQUOTA)), ARG_STR(NULL), -1, xdq, print_xdisk_quota, (intptr_t) 2); /* Q_XGETNEXTQUOTA */ check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETNEXTQUOTA, USRQUOTA)), ARG_STR("/dev/sda1"), 0, xdq, print_xdisk_quota, (intptr_t) 1); /* Q_XSETQLIM */ check_quota(CQF_NONE, ARG_STR(QCMD(Q_XSETQLIM, PRJQUOTA)), bogus_special, bogus_special_str, 0, bogus_addr); fill_memory_ex((char *) xdq, sizeof(*xdq), 0x8e); check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_XSETQLIM, PRJQUOTA)), bogus_dev, bogus_dev_str, 3141592653U, xdq, print_xdisk_quota, (intptr_t) 0); /* Q_XGETQSTAT */ check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTAT, USRQUOTA)), ARG_STR("/dev/sda1"), xqstat, print_xquota_stat, (intptr_t) 1); check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTATV, PRJQUOTA)), unterminated, unterminated_str, xqstat + 1, print_xquota_stat, (intptr_t) 2); /* Q_XGETQSTATV */ check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTAT, USRQUOTA)), ARG_STR("/dev/sda1"), xqstatv, print_xquota_statv, 1); check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTATV, GRPQUOTA)), ARG_STR(NULL), xqstatv, print_xquota_statv, (intptr_t) 2); /* Q_XQUOTARM */ check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTARM, PRJQUOTA)), bogus_special, bogus_special_str, ARG_STR(NULL)); check_quota(CQF_ID_SKIP, ARG_STR(QCMD(Q_XQUOTARM, USRQUOTA)), unterminated, unterminated_str, flags + 1); *flags = 0xdeadbeef; check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTARM, GRPQUOTA)), ARG_STR(NULL), flags, "[XFS_USER_QUOTA|XFS_PROJ_QUOTA" "|XFS_GROUP_QUOTA|0xdeadbee8]"); /* Q_XQUOTASYNC */ check_quota(CQF_ID_SKIP | CQF_ADDR_SKIP, ARG_STR(QCMD(Q_XQUOTASYNC, USRQUOTA)), bogus_special, bogus_special_str); check_quota(CQF_ID_SKIP | CQF_ADDR_SKIP, QCMD(Q_XQUOTASYNC, 0xfff), "QCMD(Q_XQUOTASYNC, 0xff /* ???QUOTA */)", ARG_STR(NULL)); puts("+++ exited with 0 +++"); return 0; }