CVS commit: [netbsd-8] src/sys/compat/common

[Martin Husemann]

Module Name:    src
Committed By:   martin
Date:           Sat Oct 10 14:36:57 UTC 2020

Modified Files:
        src/sys/compat/common [netbsd-8]: tty_43.c

Log Message:
Pull up following revision(s) (requested by nia in ticket #1614):

        sys/compat/common/tty_43.c: revision 1.38

tty_43: Check a bitset from userspace is valid before shifting it

Passing a negative value to these legacy compat ioctls results in
left shift on a negative value which is undefined behaviour and results
in the tty (at least, possibly other things) locking up.
The argument to the ioctl should always be > 0. Return EINVAL otherwise.

While here, adjustments to code style to match current guidelines.
Found by UBSan.


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.30.20.1 src/sys/compat/common/tty_43.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/compat/common/tty_43.c
diff -u src/sys/compat/common/tty_43.c:1.30 src/sys/compat/common/tty_43.c:1.30.20.1
--- src/sys/compat/common/tty_43.c:1.30	Thu May 22 16:31:19 2014
+++ src/sys/compat/common/tty_43.c	Sat Oct 10 14:36:57 2020
@@ -1,4 +1,4 @@
-/*	$NetBSD: tty_43.c,v 1.30 2014/05/22 16:31:19 dholland Exp $	*/
+/*	$NetBSD: tty_43.c,v 1.30.20.1 2020/10/10 14:36:57 martin Exp $	*/
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.30 2014/05/22 16:31:19 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.30.20.1 2020/10/10 14:36:57 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -211,20 +211,24 @@ ttcompat(struct tty *tp, u_long com, voi
 	case TIOCLBIC:
 	case TIOCLSET: {
 		struct termios term;
-		int flags;
+		int argbits, flags;
+
+		argbits = *(int *)data;
+		if (argbits < 0)
+			return EINVAL;
 
 		mutex_spin_enter(&tty_lock);
 		term = tp->t_termios;
 		flags = ttcompatgetflags(tp);
 		switch (com) {
 		case TIOCLSET:
-			tp->t_flags = (flags&0xffff) | (*(int *)data<<16);
+			tp->t_flags = (flags & 0xffff) | (argbits << 16);
 			break;
 		case TIOCLBIS:
-			tp->t_flags = flags | (*(int *)data<<16);
+			tp->t_flags = flags | (argbits << 16);
 			break;
 		case TIOCLBIC:
-			tp->t_flags = flags & ~(*(int *)data<<16);
+			tp->t_flags = flags & ~(argbits << 16);
 			break;
 		}
 		ttcompatsetlflags(tp, &term);