[src/trunk]: src/sys/compat/common tty_43: Do unsigned arithmetic to avoid sh...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/bf40e4ffd8f0
branches:  trunk
changeset: 368418:bf40e4ffd8f0
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sun Jul 10 13:57:14 2022 +0000

description:
tty_43: Do unsigned arithmetic to avoid shift into sign bits.

Omit input validation -- it's not a great idea for compatibility with
historical kernels, since they ignored the bits instead of rejecting
them if set.  With unsigned arithmetic, we get the same semantics as
was previously assumed (discarding bits that get shifted into the
sign bit or off into oblivion) without the formal undefined
behaviour.

Reported-by: syzbot+e408764cdd8c0c0ff535%syzkaller.appspotmail.com@localhost
https://syzkaller.appspot.com/bug?id=8318f0039e68187cd8d27b2c520816fff3f7266a

diffstat:

 sys/compat/common/tty_43.c |  8 +++-----
 1 files changed, 3 insertions(+), 5 deletions(-)

diffs (31 lines):

diff -r 805ef34943de -r bf40e4ffd8f0 sys/compat/common/tty_43.c
--- a/sys/compat/common/tty_43.c        Sun Jul 10 13:56:44 2022 +0000
+++ b/sys/compat/common/tty_43.c        Sun Jul 10 13:57:14 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tty_43.c,v 1.39 2020/10/10 15:59:41 christos Exp $     */
+/*     $NetBSD: tty_43.c,v 1.40 2022/07/10 13:57:14 riastradh Exp $    */
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.39 2020/10/10 15:59:41 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tty_43.c,v 1.40 2022/07/10 13:57:14 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_compat_netbsd.h"
@@ -220,11 +220,9 @@
        case TIOCLBIC:
        case TIOCLSET: {
                struct termios term;
-               int argbits, flags;
+               unsigned argbits, flags;
 
                argbits = *(int *)data;
-               if (argbits < 0)
-                       return EINVAL;
 
                mutex_spin_enter(&tty_lock);
                term = tp->t_termios;