Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/sys/arch/amd64/amd64 Do not dereference user pointer in ptra...
details: https://anonhg.NetBSD.org/src/rev/9ba523a4d945
branches: trunk
changeset: 964517:9ba523a4d945
user: kamil <kamil%NetBSD.org@localhost>
date: Tue Aug 06 01:34:29 2019 +0000
description:
Do not dereference user pointer in ptrace_machdep_dorequest()/amd64
Always use copyin(9) for reading user memory.
This fixes SMAP crash on some amd64 machines.
Reported by <msaitoh>
diffstat:
sys/arch/amd64/amd64/process_machdep.c | 25 ++++++++++++++++---------
1 files changed, 16 insertions(+), 9 deletions(-)
diffs (47 lines):
diff -r bd382ae75c35 -r 9ba523a4d945 sys/arch/amd64/amd64/process_machdep.c
--- a/sys/arch/amd64/amd64/process_machdep.c Tue Aug 06 00:19:57 2019 +0000
+++ b/sys/arch/amd64/amd64/process_machdep.c Tue Aug 06 01:34:29 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: process_machdep.c,v 1.43 2019/07/24 16:36:47 bouyer Exp $ */
+/* $NetBSD: process_machdep.c,v 1.44 2019/08/06 01:34:29 kamil Exp $ */
/*
* Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
@@ -74,7 +74,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: process_machdep.c,v 1.43 2019/07/24 16:36:47 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: process_machdep.c,v 1.44 2019/08/06 01:34:29 kamil Exp $");
#include "opt_xen.h"
#include <sys/param.h>
@@ -327,14 +327,21 @@
if (!process_machdep_validxstate(lt->l_proc))
return EINVAL;
if (__predict_false(l->l_proc->p_flag & PK_32)) {
- struct netbsd32_iovec *user_iov = addr;
- iov.iov_base = NETBSD32PTR64(user_iov->iov_base);
- iov.iov_len = user_iov->iov_len;
+ struct netbsd32_iovec user_iov;
+ if ((error = copyin(addr, &user_iov, sizeof(user_iov)))
+ != 0)
+ return error;
+
+ iov.iov_base = NETBSD32PTR64(user_iov.iov_base);
+ iov.iov_len = user_iov.iov_len;
} else {
- struct iovec *user_iov;
- user_iov = (struct iovec*)addr;
- iov.iov_base = user_iov->iov_base;
- iov.iov_len = user_iov->iov_len;
+ struct iovec user_iov;
+ if ((error = copyin(addr, &user_iov, sizeof(user_iov)))
+ != 0)
+ return error;
+
+ iov.iov_base = user_iov.iov_base;
+ iov.iov_len = user_iov.iov_len;
}
error = proc_vmspace_getref(l->l_proc, &vm);
Home |
Main Index |
Thread Index |
Old Index