From: Peter Maydell Date: Mon, 9 Aug 2021 15:54:24 +0000 (+0100) Subject: linux-user: Check lock_user result for ip_mreq_source sockopts X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=74e43b04b0260da09d14bc56a5d629d4753b8b27;p=qemu.git linux-user: Check lock_user result for ip_mreq_source sockopts In do_setsockopt(), the code path for the options which take a struct ip_mreq_source (IP_BLOCK_SOURCE, IP_UNBLOCK_SOURCE, IP_ADD_SOURCE_MEMBERSHIP and IP_DROP_SOURCE_MEMBERSHIP) fails to check the return value from lock_user(). Handle this in the usual way by returning -TARGET_EFAULT. (In practice this was probably harmless because we'd pass a NULL pointer to setsockopt() and the kernel would then return EFAULT.) Fixes: Coverity CID 1459987 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Laurent Vivier Message-Id: <20210809155424.30968-1-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier --- diff --git a/linux-user/syscall.c b/linux-user/syscall.c index e4ffdec0d8..544f5b662f 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2127,6 +2127,9 @@ static abi_long do_setsockopt(int sockfd, int level, int optname, return -TARGET_EINVAL; ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1); + if (!ip_mreq_source) { + return -TARGET_EFAULT; + } ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen)); unlock_user (ip_mreq_source, optval_addr, 0); break;