Fix bug in linux_wait4 and linux_waitpid where garbage in the status
argument could panic the kernel. Submitted by: Ian Dowse <iedowse@maths.tcd.ie> Prompted by: jkh, gallatin Approved by: prompters
This commit is contained in:
parent
2a4361cb3d
commit
0cf1a40a88
@ -988,6 +988,7 @@ linux_waitpid(struct proc *p, struct linux_waitpid_args *args)
|
|||||||
if (args->status) {
|
if (args->status) {
|
||||||
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
||||||
return error;
|
return error;
|
||||||
|
tmpstat &= 0xffff;
|
||||||
if (WIFSIGNALED(tmpstat))
|
if (WIFSIGNALED(tmpstat))
|
||||||
tmpstat = (tmpstat & 0xffffff80) |
|
tmpstat = (tmpstat & 0xffffff80) |
|
||||||
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
||||||
@ -1031,6 +1032,7 @@ linux_wait4(struct proc *p, struct linux_wait4_args *args)
|
|||||||
if (args->status) {
|
if (args->status) {
|
||||||
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
||||||
return error;
|
return error;
|
||||||
|
tmpstat &= 0xffff;
|
||||||
if (WIFSIGNALED(tmpstat))
|
if (WIFSIGNALED(tmpstat))
|
||||||
tmpstat = (tmpstat & 0xffffff80) |
|
tmpstat = (tmpstat & 0xffffff80) |
|
||||||
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
||||||
|
@ -988,6 +988,7 @@ linux_waitpid(struct proc *p, struct linux_waitpid_args *args)
|
|||||||
if (args->status) {
|
if (args->status) {
|
||||||
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
||||||
return error;
|
return error;
|
||||||
|
tmpstat &= 0xffff;
|
||||||
if (WIFSIGNALED(tmpstat))
|
if (WIFSIGNALED(tmpstat))
|
||||||
tmpstat = (tmpstat & 0xffffff80) |
|
tmpstat = (tmpstat & 0xffffff80) |
|
||||||
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
||||||
@ -1031,6 +1032,7 @@ linux_wait4(struct proc *p, struct linux_wait4_args *args)
|
|||||||
if (args->status) {
|
if (args->status) {
|
||||||
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0)
|
||||||
return error;
|
return error;
|
||||||
|
tmpstat &= 0xffff;
|
||||||
if (WIFSIGNALED(tmpstat))
|
if (WIFSIGNALED(tmpstat))
|
||||||
tmpstat = (tmpstat & 0xffffff80) |
|
tmpstat = (tmpstat & 0xffffff80) |
|
||||||
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat));
|
||||||
|
Loading…
Reference in New Issue
Block a user