Module Name: src
Committed By: maxv
Date: Sun Apr 14 09:09:55 UTC 2019
Modified Files:
src/sys/kern: uipc_socket.c
Log Message:
Add more checks, if the values are negative we hit a KASSERT later in the
timeout.
Reported-by: syzbot+662dbeb526303f458...@syzkaller.appspotmail.com
To generate a diff of this commit:
cvs rdiff -u -r1.273 -r1.274 src/sys/kern/uipc_socket.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/uipc_socket.c
diff -u src/sys/kern/uipc_socket.c:1.273 src/sys/kern/uipc_socket.c:1.274
--- src/sys/kern/uipc_socket.c:1.273 Mon Apr 8 18:38:45 2019
+++ src/sys/kern/uipc_socket.c Sun Apr 14 09:09:55 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: uipc_socket.c,v 1.273 2019/04/08 18:38:45 maxv Exp $ */
+/* $NetBSD: uipc_socket.c,v 1.274 2019/04/14 09:09:55 maxv Exp $ */
/*
* Copyright (c) 2002, 2007, 2008, 2009 The NetBSD Foundation, Inc.
@@ -71,7 +71,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.273 2019/04/08 18:38:45 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.274 2019/04/14 09:09:55 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_compat_netbsd.h"
@@ -1841,6 +1841,10 @@ sosetopt1(struct socket *so, const struc
if (error)
break;
+ if (tv.tv_sec < 0 || tv.tv_usec < 0 || tv.tv_usec >= 1000000) {
+ error = EDOM;
+ break;
+ }
if (tv.tv_sec > (INT_MAX - tv.tv_usec / tick) / hz) {
error = EDOM;
break;
