Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/sys/compat/common tty_43: Check a bitset from userspace is v...
details: https://anonhg.NetBSD.org/src/rev/75f90c128401
branches: trunk
changeset: 944724:75f90c128401
user: nia <nia%NetBSD.org@localhost>
date: Fri Oct 09 10:41:53 2020 +0000
description:
tty_43: Check a bitset from userspace is valid before shifting it
Passing a negative value to these legacy compat ioctls results in
left shift on a negative value which is undefined behaviour and results
in the tty (at least, possibly other things) locking up.
The argument to the ioctl should always be > 0. Return EINVAL otherwise.
While here, adjustments to code style to match current guidelines.
Found by UBSan.
Reported-by: syzbot+39cd551a05298b222756%syzkaller.appspotmail.com@localhost
diffstat:
sys/compat/common/tty_43.c | 16 ++++++++++------
1 files changed, 10 insertions(+), 6 deletions(-)
diffs (47 lines):
diff -r e2fcd772c914 -r 75f90c128401 sys/compat/common/tty_43.c
--- a/sys/compat/common/tty_43.c Fri Oct 09 09:03:55 2020 +0000
+++ b/sys/compat/common/tty_43.c Fri Oct 09 10:41:53 2020 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: tty_43.c,v 1.37 2020/08/08 19:04:58 christos Exp $ */
+/* $NetBSD: tty_43.c,v 1.38 2020/10/09 10:41:53 nia Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.37 2020/08/08 19:04:58 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.38 2020/10/09 10:41:53 nia Exp $");
#if defined(_KERNEL_OPT)
#include "opt_compat_netbsd.h"
@@ -220,20 +220,24 @@
case TIOCLBIC:
case TIOCLSET: {
struct termios term;
- int flags;
+ int argbits, flags;
+
+ argbits = *(int *)data;
+ if (argbits < 0)
+ return EINVAL;
mutex_spin_enter(&tty_lock);
term = tp->t_termios;
flags = ttcompatgetflags(tp);
switch (com) {
case TIOCLSET:
- tp->t_flags = (flags&0xffff) | (*(int *)data<<16);
+ tp->t_flags = (flags & 0xffff) | (argbits << 16);
break;
case TIOCLBIS:
- tp->t_flags = flags | (*(int *)data<<16);
+ tp->t_flags = flags | (argbits << 16);
break;
case TIOCLBIC:
- tp->t_flags = flags & ~(*(int *)data<<16);
+ tp->t_flags = flags & ~(argbits << 16);
break;
}
ttcompatsetlflags(tp, &term);
Home |
Main Index |
Thread Index |
Old Index