CVS commit: [netbsd-9] src/sys/arch/amd64/amd64

[Martin Husemann]

Module Name:    src
Committed By:   martin
Date:           Tue Aug  6 16:14:33 UTC 2019

Modified Files:
        src/sys/arch/amd64/amd64 [netbsd-9]: process_machdep.c

Log Message:
Pull up following revision(s) (requested by kamil in ticket #19):

        sys/arch/amd64/amd64/process_machdep.c: revision 1.44

Do not dereference user pointer in ptrace_machdep_dorequest()/amd64

Always use copyin(9) for reading user memory.

This fixes SMAP crash on some amd64 machines.

Reported by <msaitoh>


To generate a diff of this commit:
cvs rdiff -u -r1.43 -r1.43.2.1 src/sys/arch/amd64/amd64/process_machdep.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/arch/amd64/amd64/process_machdep.c
diff -u src/sys/arch/amd64/amd64/process_machdep.c:1.43 src/sys/arch/amd64/amd64/process_machdep.c:1.43.2.1
--- src/sys/arch/amd64/amd64/process_machdep.c:1.43	Wed Jul 24 16:36:47 2019
+++ src/sys/arch/amd64/amd64/process_machdep.c	Tue Aug  6 16:14:33 2019
@@ -1,4 +1,4 @@
-/*	$NetBSD: process_machdep.c,v 1.43 2019/07/24 16:36:47 bouyer Exp $	*/
+/*	$NetBSD: process_machdep.c,v 1.43.2.1 2019/08/06 16:14:33 martin Exp $	*/
 
 /*
  * Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
@@ -74,7 +74,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: process_machdep.c,v 1.43 2019/07/24 16:36:47 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: process_machdep.c,v 1.43.2.1 2019/08/06 16:14:33 martin Exp $");
 
 #include "opt_xen.h"
 #include <sys/param.h>
@@ -327,14 +327,21 @@ ptrace_machdep_dorequest(
 		if (!process_machdep_validxstate(lt->l_proc))
 			return EINVAL;
 		if (__predict_false(l->l_proc->p_flag & PK_32)) {
-			struct netbsd32_iovec *user_iov = addr;
-			iov.iov_base = NETBSD32PTR64(user_iov->iov_base);
-			iov.iov_len = user_iov->iov_len;
+			struct netbsd32_iovec user_iov;
+			if ((error = copyin(addr, &user_iov, sizeof(user_iov)))
+			    != 0)
+				return error;
+
+			iov.iov_base = NETBSD32PTR64(user_iov.iov_base);
+			iov.iov_len = user_iov.iov_len;
 		} else {
-			struct iovec *user_iov;
-			user_iov = (struct iovec*)addr;
-			iov.iov_base = user_iov->iov_base;
-			iov.iov_len = user_iov->iov_len;
+			struct iovec user_iov;
+			if ((error = copyin(addr, &user_iov, sizeof(user_iov)))
+			    != 0)
+				return error;
+
+			iov.iov_base = user_iov.iov_base;
+			iov.iov_len = user_iov.iov_len;
 		}
 
 		error = proc_vmspace_getref(l->l_proc, &vm);