Module Name: src
Committed By: nia
Date: Thu Dec 24 12:14:50 UTC 2020
Modified Files:
src/sys/kern: kern_descrip.c kern_proc.c
Log Message:
Avoid negating the minimum size of pid_t (this overflows).
Reported-by: syzbot+e2eb02f9dfaf4f2e6...@syzkaller.appspotmail.com
To generate a diff of this commit:
cvs rdiff -u -r1.249 -r1.250 src/sys/kern/kern_descrip.c
cvs rdiff -u -r1.261 -r1.262 src/sys/kern/kern_proc.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/kern_descrip.c
diff -u src/sys/kern/kern_descrip.c:1.249 src/sys/kern/kern_descrip.c:1.250
--- src/sys/kern/kern_descrip.c:1.249 Fri Aug 28 10:20:14 2020
+++ src/sys/kern/kern_descrip.c Thu Dec 24 12:14:50 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_descrip.c,v 1.249 2020/08/28 10:20:14 christos Exp $ */
+/* $NetBSD: kern_descrip.c,v 1.250 2020/12/24 12:14:50 nia Exp $ */
/*-
* Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -70,7 +70,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_descrip.c,v 1.249 2020/08/28 10:20:14 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_descrip.c,v 1.250 2020/12/24 12:14:50 nia Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -1767,6 +1767,9 @@ fsetown(pid_t *pgid, u_long cmd, const v
pid_t id = *(const pid_t *)data;
int error;
+ if (id == INT_MIN)
+ return EINVAL;
+
switch (cmd) {
case TIOCSPGRP:
if (id < 0)
Index: src/sys/kern/kern_proc.c
diff -u src/sys/kern/kern_proc.c:1.261 src/sys/kern/kern_proc.c:1.262
--- src/sys/kern/kern_proc.c:1.261 Thu Sep 17 11:37:35 2020
+++ src/sys/kern/kern_proc.c Thu Dec 24 12:14:50 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_proc.c,v 1.261 2020/09/17 11:37:35 martin Exp $ */
+/* $NetBSD: kern_proc.c,v 1.262 2020/12/24 12:14:50 nia Exp $ */
/*-
* Copyright (c) 1999, 2006, 2007, 2008, 2020 The NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_proc.c,v 1.261 2020/09/17 11:37:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_proc.c,v 1.262 2020/12/24 12:14:50 nia Exp $");
#ifdef _KERNEL_OPT
#include "opt_kstack.h"
@@ -619,6 +619,9 @@ pgid_in_session(struct proc *p, pid_t pg
struct session *session;
int error;
+ if (pg_id == INT_MIN)
+ return EINVAL;
+
mutex_enter(&proc_lock);
if (pg_id < 0) {
struct proc *p1 = proc_find(-pg_id);
