qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH] Fix stack corruption when handling PR_GETDEATHSIG


From: Stephen Long
Subject: [PATCH] Fix stack corruption when handling PR_GETDEATHSIG
Date: Wed, 6 May 2020 16:47:51 -0700

From: Ana Pazos <address@hidden>

Signed-off-by: Ana Pazos <address@hidden>
---
Submitting this patch on behalf of Ana Pazos. The bug was triggered by
the following c file on aarch64-linux-user.

> #include <signal.h>
> #include <sys/prctl.h>
>
> int main() {
>   int PDeachSig = 0;
>   if (prctl(PR_GET_PDEATHSIG, &PDeachSig) == 0 && PDeachSig == SIGKILL)
>     prctl(PR_SET_PDEATHSIG, 0);
>   return (PDeachSig == SIGKILL);
> }

 linux-user/syscall.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 05f03919ff..4eac567f97 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -10253,10 +10253,10 @@ static abi_long do_syscall1(void *cpu_env, int num, 
abi_long arg1,
         switch (arg1) {
         case PR_GET_PDEATHSIG:
         {
-            int deathsig;
+            uint32_t deathsig;
             ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
             if (!is_error(ret) && arg2
-                && put_user_ual(deathsig, arg2)) {
+                && put_user_u32(deathsig, arg2)) {
                 return -TARGET_EFAULT;
             }
             return ret;
-- 
2.17.1




reply via email to

[Prev in Thread] Current Thread [Next in Thread]