diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2021-08-09 16:54:24 +0100 |
|---|---|---|
| committer | Laurent Vivier <laurent@vivier.eu> | 2021-09-16 17:04:21 +0200 |
| commit | 74e43b04b0260da09d14bc56a5d629d4753b8b27 (patch) | |
| tree | ef6cf66ed2a63f75cd544d397f36e5ca8f525e71 /linux-user | |
| parent | d0a7920eb4fc44dd4485167edf7db7fac1de6977 (diff) | |
| download | focaccia-qemu-74e43b04b0260da09d14bc56a5d629d4753b8b27.tar.gz focaccia-qemu-74e43b04b0260da09d14bc56a5d629d4753b8b27.zip | |
linux-user: Check lock_user result for ip_mreq_source sockopts
In do_setsockopt(), the code path for the options which take a struct ip_mreq_source (IP_BLOCK_SOURCE, IP_UNBLOCK_SOURCE, IP_ADD_SOURCE_MEMBERSHIP and IP_DROP_SOURCE_MEMBERSHIP) fails to check the return value from lock_user(). Handle this in the usual way by returning -TARGET_EFAULT. (In practice this was probably harmless because we'd pass a NULL pointer to setsockopt() and the kernel would then return EFAULT.) Fixes: Coverity CID 1459987 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210809155424.30968-1-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Diffstat (limited to 'linux-user')
| -rw-r--r-- | linux-user/syscall.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index e4ffdec0d8..544f5b662f 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2127,6 +2127,9 @@ static abi_long do_setsockopt(int sockfd, int level, int optname, return -TARGET_EINVAL; ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1); + if (!ip_mreq_source) { + return -TARGET_EFAULT; + } ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen)); unlock_user (ip_mreq_source, optval_addr, 0); break; |