Sat Oct 12 12:04:37 2019 UTC ()

Avoid signed integer overflow for -lwp where lwp is INT_MIN

Reported-by: syzbot+68b80b44b898e66da3fc@syzkaller.appspotmail.com


(kamil)

diff -r1.66 -r1.67 src/sys/kern/sys_ptrace_common.c

--- src/sys/kern/sys_ptrace_common.c 2019/10/09 13:19:43	1.66
+++ src/sys/kern/sys_ptrace_common.c 2019/10/12 12:04:37	1.67

 @@ -1,14 +1,14 @@
-/*	$NetBSD: sys_ptrace_common.c,v 1.66 2019/10/09 13:19:43 kamil Exp $	*/
+/*	$NetBSD: sys_ptrace_common.c,v 1.67 2019/10/12 12:04:37 kamil Exp $	*/
 /*-
  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Andrew Doran.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -108,27 +108,27 @@
 /*
  * References:
  *	(1) Bach's "The Design of the UNIX Operating System",
  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
  *	(3) the "4.4BSD Programmer's Reference Manual" published
  *		by USENIX and O'Reilly & Associates.
  * The 4.4BSD PRM does a reasonably good job of documenting what the various
  * ptrace() requests should actually do, and its text is quoted several times
  * in this file.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.66 2019/10/09 13:19:43 kamil Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.67 2019/10/12 12:04:37 kamil Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_ptrace.h"
 #include "opt_ktrace.h"
 #include "opt_pax.h"
 #include "opt_compat_netbsd32.h"
 #endif
 #if defined(__HAVE_COMPAT_NETBSD32) && !defined(COMPAT_NETBSD32) \
     && !defined(_RUMPKERNEL)
 #define COMPAT_NETBSD32
 #endif
 @@ -1192,28 +1192,32 @@ do_ptrace(struct ptrace_methods *ptm, st
 		 * data is the signo to deliver to the process.
 		 */
 		tmp = data;
 		if (tmp >= 0) {
 #ifdef PT_STEP
 			if (req == PT_STEP)
 				signo = 0;
 			else
 #endif
+			{
 				signo = tmp;
 				tmp = 0;	/* don't search for LWP */
+			}
-		} else
+		} else if (tmp == INT_MIN) {
 			error = ESRCH;
 			break;
 		} else {
 			tmp = -tmp;
+		}
 		if (tmp > 0) {
 			if (req == PT_DETACH) {
 				error = EINVAL;
 				break;
+			}
 			lwp_delref2 (lt);
 			lt = lwp_find(t, tmp);
 			if (lt == NULL) {
 				error = ESRCH;
 				break;
+			}
 			lwp_addref(lt);