From: Laurent Vivier <laurent@vivier.eu>
To: qemu-devel@nongnu.org
Cc: Ana Pazos <apazos@quicinc.com>,
Laurent Vivier <laurent@vivier.eu>,
Stephen Long <steplong@quicinc.com>
Subject: [PULL 1/8] Fix stack smashing when handling PR_GET_PDEATHSIG
Date: Mon, 26 Oct 2020 23:03:32 +0100 [thread overview]
Message-ID: <20201026220339.195790-2-laurent@vivier.eu> (raw)
In-Reply-To: <20201026220339.195790-1-laurent@vivier.eu>
From: Stephen Long <steplong@quicinc.com>
The bug was triggered by the following code on aarch64-linux-user:
int main(void)
{
int PDeathSig = 0;
if (prctl(PR_GET_PDEATHSIG, &PDeathSig) == 0 && PDeathSig == SIGKILL)
prctl(PR_GET_PDEATHSIG, 0);
return (PDeathSig == SIGKILL);
}
Signed-off-by: Stephen Long <steplong@quicinc.com>
Signed-off-by: Ana Pazos <apazos@quicinc.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20200507130302.3684-1-steplong@quicinc.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
linux-user/syscall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 897d20c076ce..3e0f14f2e67f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -10703,7 +10703,7 @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
int deathsig;
ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
if (!is_error(ret) && arg2
- && put_user_ual(deathsig, arg2)) {
+ && put_user_s32(deathsig, arg2)) {
return -TARGET_EFAULT;
}
return ret;
--
2.26.2
next prev parent reply other threads:[~2020-10-26 22:06 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-26 22:03 [PULL 0/8] Linux user for 5.2 patches Laurent Vivier
2020-10-26 22:03 ` Laurent Vivier [this message]
2020-10-26 22:03 ` [PULL 2/8] linux-user: Support f_flags in statfs64 when available Laurent Vivier
2020-10-26 22:03 ` [PULL 3/8] linux-user: update syscall_nr.h to Linux 5.9-rc7 Laurent Vivier
2020-10-26 22:03 ` [PULL 4/8] linux-user: update mips/syscall-args-o32.c.inc " Laurent Vivier
2020-10-26 22:03 ` [PULL 5/8] linux-user: update syscall.tbl " Laurent Vivier
2020-10-26 22:03 ` [PULL 6/8] linux-user: remove _sysctl Laurent Vivier
2020-10-26 22:03 ` [PULL 7/8] linux-user: correct errno returned from accept4() syscall Laurent Vivier
2020-10-26 22:03 ` [PULL 8/8] target/xtensa: enable all coprocessors for linux-user Laurent Vivier
2020-10-28 16:25 ` [PULL 0/8] Linux user for 5.2 patches Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201026220339.195790-2-laurent@vivier.eu \
--to=laurent@vivier.eu \
--cc=apazos@quicinc.com \
--cc=qemu-devel@nongnu.org \
--cc=steplong@quicinc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.