[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG
From: |
Laurent Vivier |
Subject: |
Re: [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG |
Date: |
Thu, 7 May 2020 21:58:48 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 |
Le 07/05/2020 à 15:03, Stephen Long a écrit :
> The bug was triggered by the following code on aarch64-linux-user:
>
> #include <signal.h>
> #include <sys/prctl.h>
>
> int main(void)
> {
> int PDeathSig = 0;
> if (prctl(PR_GET_PDEATHSIG, &PDeathSig) == 0 && PDeathSig == SIGKILL)
> prctl(PR_GET_PDEATHSIG, 0);
> return (PDeathSig == SIGKILL);
> }
>
> Signed-off-by: Stephen Long <address@hidden>
> Signed-off-by: Ana Pazos <address@hidden>
> ---
>
> I fixed the incorrect subject line. PR_GETDEATHSIG should be PR_GET_PDEATHSIG.
> Is there a test folder where I can include the code that triggered the bug?
Perhaps Alex Bennée knows?
> Also, I thought "int" can be 2 bytes on some machines.
According to my K&R, 4th edition, it could be on 16bit systems, like
PDP-11, but we don't support them ;)
Reviewed-by: Laurent Vivier <address@hidden>
>
> linux-user/syscall.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 05f03919ff..91f91147ba 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -10256,7 +10256,7 @@ static abi_long do_syscall1(void *cpu_env, int num,
> abi_long arg1,
> int deathsig;
> ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
> if (!is_error(ret) && arg2
> - && put_user_ual(deathsig, arg2)) {
> + && put_user_s32(deathsig, arg2)) {
> return -TARGET_EFAULT;
> }
> return ret;
>