CVS commit: src/sys/arch/amd64/amd64

[Kamil Rytarowski]

Module Name:    src
Committed By:   kamil
Date:           Tue Aug  6 01:34:29 UTC 2019

Modified Files:
        src/sys/arch/amd64/amd64: process_machdep.c

Log Message:
Do not dereference user pointer in ptrace_machdep_dorequest()/amd64

Always use copyin(9) for reading user memory.

This fixes SMAP crash on some amd64 machines.

Reported by <msaitoh>


To generate a diff of this commit:
cvs rdiff -u -r1.43 -r1.44 src/sys/arch/amd64/amd64/process_machdep.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/arch/amd64/amd64/process_machdep.c
diff -u src/sys/arch/amd64/amd64/process_machdep.c:1.43 src/sys/arch/amd64/amd64/process_machdep.c:1.44
--- src/sys/arch/amd64/amd64/process_machdep.c:1.43	Wed Jul 24 16:36:47 2019
+++ src/sys/arch/amd64/amd64/process_machdep.c	Tue Aug  6 01:34:29 2019
@@ -1,4 +1,4 @@
-/*	$NetBSD: process_machdep.c,v 1.43 2019/07/24 16:36:47 bouyer Exp $	*/
+/*	$NetBSD: process_machdep.c,v 1.44 2019/08/06 01:34:29 kamil Exp $	*/
 
 /*
  * Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
@@ -74,7 +74,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: process_machdep.c,v 1.43 2019/07/24 16:36:47 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: process_machdep.c,v 1.44 2019/08/06 01:34:29 kamil Exp $");
 
 #include "opt_xen.h"
 #include <sys/param.h>
@@ -327,14 +327,21 @@ ptrace_machdep_dorequest(
 		if (!process_machdep_validxstate(lt->l_proc))
 			return EINVAL;
 		if (__predict_false(l->l_proc->p_flag & PK_32)) {
-			struct netbsd32_iovec *user_iov = addr;
-			iov.iov_base = NETBSD32PTR64(user_iov->iov_base);
-			iov.iov_len = user_iov->iov_len;
+			struct netbsd32_iovec user_iov;
+			if ((error = copyin(addr, &user_iov, sizeof(user_iov)))
+			    != 0)
+				return error;
+
+			iov.iov_base = NETBSD32PTR64(user_iov.iov_base);
+			iov.iov_len = user_iov.iov_len;
 		} else {
-			struct iovec *user_iov;
-			user_iov = (struct iovec*)addr;
-			iov.iov_base = user_iov->iov_base;
-			iov.iov_len = user_iov->iov_len;
+			struct iovec user_iov;
+			if ((error = copyin(addr, &user_iov, sizeof(user_iov)))
+			    != 0)
+				return error;
+
+			iov.iov_base = user_iov.iov_base;
+			iov.iov_len = user_iov.iov_len;
 		}
 
 		error = proc_vmspace_getref(l->l_proc, &vm);