Re: [Qemu-devel] [PATCH] Avoid crash in epoll_ctl with EPOLL_CTL_DEL

[Laurent Vivier]

Le 30/05/2019 à 17:25, Giuseppe Musacchio a écrit :
> The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
> do the same and avoid returning EFAULT if garbage is passed instead of a
> valid pointer.
> 
> Signed-off-by: Giuseppe Musacchio <address@hidden>
> ---
>  linux-user/syscall.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 5e29e675e9..32d463d58d 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -11329,7 +11329,7 @@ static abi_long do_syscall1(void *cpu_env, int
> num, abi_long arg1,
>      {
>          struct epoll_event ep;
>          struct epoll_event *epp = 0;
> -        if (arg4) {
> +        if (arg2 != EPOLL_CTL_DEL && arg4) {
>              struct target_epoll_event *target_ep;
>              if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
>                  return -TARGET_EFAULT;

Reviewed-by: Laurent Vivier <address@hidden>