Fix bug in linux_wait4 and linux_waitpid where garbage in the status

argument could panic the kernel.

Submitted by: Ian Dowse <iedowse@maths.tcd.ie>
Prompted by: jkh, gallatin
Approved by: prompters
This commit is contained in:
marcel 2000-03-09 17:52:01 +00:00
parent 2a4361cb3d
commit 0cf1a40a88
2 changed files with 4 additions and 0 deletions

View File

@ -988,6 +988,7 @@ linux_waitpid(struct proc *p, struct linux_waitpid_args *args)
if (args->status) {
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
return error;
tmpstat &= 0xffff;
if (WIFSIGNALED(tmpstat))
tmpstat = (tmpstat & 0xffffff80) |
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
@ -1031,6 +1032,7 @@ linux_wait4(struct proc *p, struct linux_wait4_args *args)
if (args->status) {
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
return error;
tmpstat &= 0xffff;
if (WIFSIGNALED(tmpstat))
tmpstat = (tmpstat & 0xffffff80) |
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));

View File

@ -988,6 +988,7 @@ linux_waitpid(struct proc *p, struct linux_waitpid_args *args)
if (args->status) {
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
return error;
tmpstat &= 0xffff;
if (WIFSIGNALED(tmpstat))
tmpstat = (tmpstat & 0xffffff80) |
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
@ -1031,6 +1032,7 @@ linux_wait4(struct proc *p, struct linux_wait4_args *args)
if (args->status) {
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
return error;
tmpstat &= 0xffff;
if (WIFSIGNALED(tmpstat))
tmpstat = (tmpstat & 0xffffff80) |
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));