From 74e43b04b0260da09d14bc56a5d629d4753b8b27 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Mon, 9 Aug 2021 16:54:24 +0100 Subject: [PATCH] linux-user: Check lock_user result for ip_mreq_source sockopts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In do_setsockopt(), the code path for the options which take a struct ip_mreq_source (IP_BLOCK_SOURCE, IP_UNBLOCK_SOURCE, IP_ADD_SOURCE_MEMBERSHIP and IP_DROP_SOURCE_MEMBERSHIP) fails to check the return value from lock_user(). Handle this in the usual way by returning -TARGET_EFAULT. (In practice this was probably harmless because we'd pass a NULL pointer to setsockopt() and the kernel would then return EFAULT.) Fixes: Coverity CID 1459987 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Laurent Vivier Message-Id: <20210809155424.30968-1-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier --- linux-user/syscall.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index e4ffdec0d8..544f5b662f 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2127,6 +2127,9 @@ static abi_long do_setsockopt(int sockfd, int level, int optname, return -TARGET_EINVAL; ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1); + if (!ip_mreq_source) { + return -TARGET_EFAULT; + } ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen)); unlock_user (ip_mreq_source, optval_addr, 0); break;