Module Name: src
Committed By: nia
Date: Sat Oct 10 14:07:18 UTC 2020
Modified Files:
src/sys/kern: tty.c
Log Message:
tty: Negating INT_MIN will overflow int, bail out with EINVAL
Detected by UBSan
Reported-by: syzbot+92c0fca82b74a9798...@syzkaller.appspotmail.com
To generate a diff of this commit:
cvs rdiff -u -r1.290 -r1.291 src/sys/kern/tty.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/tty.c
diff -u src/sys/kern/tty.c:1.290 src/sys/kern/tty.c:1.291
--- src/sys/kern/tty.c:1.290 Fri Oct 9 09:03:55 2020
+++ src/sys/kern/tty.c Sat Oct 10 14:07:18 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: tty.c,v 1.290 2020/10/09 09:03:55 nia Exp $ */
+/* $NetBSD: tty.c,v 1.291 2020/10/10 14:07:18 nia Exp $ */
/*-
* Copyright (c) 2008, 2020 The NetBSD Foundation, Inc.
@@ -63,7 +63,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.290 2020/10/09 09:03:55 nia Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tty.c,v 1.291 2020/10/10 14:07:18 nia Exp $");
#ifdef _KERNEL_OPT
#include "opt_compat_netbsd.h"
@@ -1302,6 +1302,10 @@ ttioctl(struct tty *tp, u_long cmd, void
}
if (pgid < 0) {
+ if (pgid == INT_MIN) {
+ mutex_exit(&proc_lock);
+ return (EINVAL);
+ }
pgrp = pgrp_find(-pgid);
if (pgrp == NULL) {
mutex_exit(&proc_lock);
