Although aio_nbytes is size_t, later is is signed to
casted types: to ssize_t in filesystem code and to int in buf code, thus supplying a negative argument leads to kernel panic later. To fix that check user supplied argument in the beginning of syscall. Submitted by: Maxim Dounin <mdounin mdounin.ru>, maxim@
This commit is contained in:
parent
2930db16a0
commit
434ea137cc
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=230583
@ -1552,6 +1552,12 @@ aio_aqueue(struct thread *td, struct aiocb *job, struct aioliojob *lj,
|
||||
return (error);
|
||||
}
|
||||
|
||||
/* XXX: aio_nbytes is later casted to signed types. */
|
||||
if ((int)aiocbe->uaiocb.aio_nbytes < 0) {
|
||||
uma_zfree(aiocb_zone, aiocbe);
|
||||
return (EINVAL);
|
||||
}
|
||||
|
||||
if (aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_KEVENT &&
|
||||
aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_SIGNAL &&
|
||||
aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_THREAD_ID &&
|
||||
|
Loading…
Reference in New Issue
Block a user