[src/netbsd-9]: src/sys/compat/common Pull up following revision(s) (requeste...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ee2728da3534
branches:  netbsd-9
changeset: 940574:ee2728da3534
user:      martin <martin%NetBSD.org@localhost>
date:      Sat Oct 10 14:35:06 2020 +0000

description:
Pull up following revision(s) (requested by nia in ticket #1106):

        sys/compat/common/tty_43.c: revision 1.38

tty_43: Check a bitset from userspace is valid before shifting it

Passing a negative value to these legacy compat ioctls results in
left shift on a negative value which is undefined behaviour and results
in the tty (at least, possibly other things) locking up.
The argument to the ioctl should always be > 0. Return EINVAL otherwise.

While here, adjustments to code style to match current guidelines.
Found by UBSan.

diffstat:

 sys/compat/common/tty_43.c |  16 ++++++++++------
 1 files changed, 10 insertions(+), 6 deletions(-)

diffs (47 lines):

diff -r 595d49b21029 -r ee2728da3534 sys/compat/common/tty_43.c
--- a/sys/compat/common/tty_43.c        Thu Oct 08 18:11:21 2020 +0000
+++ b/sys/compat/common/tty_43.c        Sat Oct 10 14:35:06 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tty_43.c,v 1.34 2019/03/01 11:06:56 pgoyette Exp $     */
+/*     $NetBSD: tty_43.c,v 1.34.4.1 2020/10/10 14:35:06 martin Exp $   */
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.34 2019/03/01 11:06:56 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.34.4.1 2020/10/10 14:35:06 martin Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_compat_netbsd.h"
@@ -220,20 +220,24 @@
        case TIOCLBIC:
        case TIOCLSET: {
                struct termios term;
-               int flags;
+               int argbits, flags;
+
+               argbits = *(int *)data;
+               if (argbits < 0)
+                       return EINVAL;
 
                mutex_spin_enter(&tty_lock);
                term = tp->t_termios;
                flags = ttcompatgetflags(tp);
                switch (com) {
                case TIOCLSET:
-                       tp->t_flags = (flags&0xffff) | (*(int *)data<<16);
+                       tp->t_flags = (flags & 0xffff) | (argbits << 16);
                        break;
                case TIOCLBIS:
-                       tp->t_flags = flags | (*(int *)data<<16);
+                       tp->t_flags = flags | (argbits << 16);
                        break;
                case TIOCLBIC:
-                       tp->t_flags = flags & ~(*(int *)data<<16);
+                       tp->t_flags = flags & ~(argbits << 16);
                        break;
                }
                ttcompatsetlflags(tp, &term);