ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

linux-user: Prevent crash in epoll_ctl 

From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
From: Giuseppe Musacchio <thatlemon@gmail.com>
Date: Fri, 17 Apr 2020 17:25:07 +0200
Subject: [PATCH] linux-user: Prevent crash in epoll_ctl

The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
do the same and avoid returning EFAULT if garbage is passed instead of a
valid pointer.

Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <a244fa67-dace-abdb-995a-3198bd80fee8@gmail.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This commit is contained in:
LemonBoy 2020-04-17 17:34:54 +02:00 committed by Laurent Vivier
parent ce437484fc
commit c7811022eb
1 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
linux-user/syscall.c
View File

@ -12590,17 +12590,25 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
struct epoll_event ep; struct epoll_event ep;
struct epoll_event *epp = 0; struct epoll_event *epp = 0;
if (arg4) { if (arg4) {
struct target_epoll_event *target_ep; if (arg2 != EPOLL_CTL_DEL) {
if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) { struct target_epoll_event *target_ep;
return -TARGET_EFAULT; if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
return -TARGET_EFAULT;
}
ep.events = tswap32(target_ep->events);
/*
* The epoll_data_t union is just opaque data to the kernel,
* so we transfer all 64 bits across and need not worry what
* actual data type it is.
*/
ep.data.u64 = tswap64(target_ep->data.u64);
unlock_user_struct(target_ep, arg4, 0);
} }
ep.events = tswap32(target_ep->events); /*
/* The epoll_data_t union is just opaque data to the kernel, * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
* so we transfer all 64 bits across and need not worry what * non-null pointer, even though this argument is ignored.
* actual data type it is. *
*/ */
ep.data.u64 = tswap64(target_ep->data.u64);
unlock_user_struct(target_ep, arg4, 0);
epp = &ep; epp = &ep;
} }
return get_errno(epoll_ctl(arg1, arg2, arg3, epp)); return get_errno(epoll_ctl(arg1, arg2, arg3, epp));