Module Name:    src
Committed By:   thorpej
Date:           Sat Apr  3 21:52:20 UTC 2021

Modified Files:
        src/sys/kern [thorpej-futex]: sys_futex.c

Log Message:
futex_func_wait(): If TIMER_ABSTIME, sanity check that the deadline
provided by the caller is not ridiculous.


To generate a diff of this commit:
cvs rdiff -u -r1.11.2.1 -r1.11.2.2 src/sys/kern/sys_futex.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/kern/sys_futex.c
diff -u src/sys/kern/sys_futex.c:1.11.2.1 src/sys/kern/sys_futex.c:1.11.2.2
--- src/sys/kern/sys_futex.c:1.11.2.1	Sun Nov  1 15:16:43 2020
+++ src/sys/kern/sys_futex.c	Sat Apr  3 21:52:20 2021
@@ -1,4 +1,4 @@
-/*	$NetBSD: sys_futex.c,v 1.11.2.1 2020/11/01 15:16:43 thorpej Exp $	*/
+/*	$NetBSD: sys_futex.c,v 1.11.2.2 2021/04/03 21:52:20 thorpej Exp $	*/
 
 /*-
  * Copyright (c) 2018, 2019, 2020 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sys_futex.c,v 1.11.2.1 2020/11/01 15:16:43 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sys_futex.c,v 1.11.2.2 2021/04/03 21:52:20 thorpej Exp $");
 
 /*
  * Futexes
@@ -1367,7 +1367,15 @@ futex_func_wait(bool shared, int *uaddr,
 		return EAGAIN;
 
 	/* Determine a deadline on the specified clock.  */
-	if (timeout == NULL || (clkflags & TIMER_ABSTIME) == TIMER_ABSTIME) {
+	if (timeout == NULL) {
+		deadline = timeout;
+	} else if ((clkflags & TIMER_ABSTIME) == TIMER_ABSTIME) {
+		/* Sanity-check the deadline. */
+		if (timeout->tv_sec < 0 ||
+		    timeout->tv_nsec < 0 ||
+		    timeout->tv_nsec >= 1000000000L) {
+			return EINVAL;
+		}
 		deadline = timeout;
 	} else {
 		struct timespec interval = *timeout;
@@ -1920,7 +1928,7 @@ futex_func_rw_wait(bool shared, int *uad
 	}
 
 	/*
-	 * Now wait.  futex_wait() will dop our op lock once we
+	 * Now wait.  futex_wait() will drop our op lock once we
 	 * are entered into the sleep queue, thus ensuring atomicity
 	 * of wakes with respect to waits.
 	 *

Reply via email to