[src/trunk]: src/sys/kern tty: Negating INT_MIN will overflow int, bail out w...

[nia <nia%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5f1604696f7b
branches:  trunk
changeset: 976970:5f1604696f7b
user:      nia <nia%NetBSD.org@localhost>
date:      Sat Oct 10 14:07:18 2020 +0000

description:
tty: Negating INT_MIN will overflow int, bail out with EINVAL

Detected by UBSan

Reported-by: syzbot+92c0fca82b74a9798b78%syzkaller.appspotmail.com@localhost

diffstat:

 sys/kern/tty.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 5cfcc435f363 -r 5f1604696f7b sys/kern/tty.c
--- a/sys/kern/tty.c    Sat Oct 10 13:41:14 2020 +0000
+++ b/sys/kern/tty.c    Sat Oct 10 14:07:18 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tty.c,v 1.290 2020/10/09 09:03:55 nia Exp $    */
+/*     $NetBSD: tty.c,v 1.291 2020/10/10 14:07:18 nia Exp $    */
 
 /*-
  * Copyright (c) 2008, 2020 The NetBSD Foundation, Inc.
@@ -63,7 +63,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.290 2020/10/09 09:03:55 nia Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.291 2020/10/10 14:07:18 nia Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_compat_netbsd.h"
@@ -1302,6 +1302,10 @@
                }
 
                if (pgid < 0) {
+                       if (pgid == INT_MIN) {
+                               mutex_exit(&proc_lock);
+                               return (EINVAL);
+                       }
                        pgrp = pgrp_find(-pgid);
                        if (pgrp == NULL) {
                                mutex_exit(&proc_lock);