Re: [PATCH] Fix stack corruption when handling PR_GETDEATHSIG

[Laurent Vivier]

Le 07/05/2020 à 01:47, Stephen Long a écrit :
> From: Ana Pazos <address@hidden>
> 
> Signed-off-by: Ana Pazos <address@hidden>
> ---
> Submitting this patch on behalf of Ana Pazos. The bug was triggered by
> the following c file on aarch64-linux-user.
> 
>> #include <signal.h>
>> #include <sys/prctl.h>
>>
>> int main() {
>>   int PDeachSig = 0;
>>   if (prctl(PR_GET_PDEATHSIG, &PDeachSig) == 0 && PDeachSig == SIGKILL)
>>     prctl(PR_SET_PDEATHSIG, 0);
>>   return (PDeachSig == SIGKILL);
>> }


Put the example in the description of the patch, it will help to
understand the fix by being kept in the log.

>  linux-user/syscall.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 05f03919ff..4eac567f97 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -10253,10 +10253,10 @@ static abi_long do_syscall1(void *cpu_env, int num, 
> abi_long arg1,
>          switch (arg1) {
>          case PR_GET_PDEATHSIG:
>          {
> -            int deathsig;
> +            uint32_t deathsig;
>              ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
>              if (!is_error(ret) && arg2
> -                && put_user_ual(deathsig, arg2)) {
> +                && put_user_u32(deathsig, arg2)) {
>                  return -TARGET_EFAULT;
>              }
>              return ret;
> 

I think you could keep the "int" and only replace put_user_ual() by
put_user_s32() (to stay in line with the man page that mentions "(int
*)". "int" is always a signed 32bit..

And add your "Signed-off-by".

Thanks,
Laurent