Don't check bad iovec array in process_vm_readv/writev. Bug #369441.

Found by LTP testcases/kernel/syscalls/cma/process_vm01.

git-svn-id: svn://svn.valgrind.org/valgrind/trunk@15997

diff --git a/NEWS b/NEWS
index 2ded124ff6d865c5dac3c9c6b537fd508df4cf72..a0b8e16100413fbe51a1091221f745f4ec70cafb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -187,6 +187,7 @@ where XXXXXX is the bug number as listed below.
 369362  Bad sigaction arguments crash valgrind
 369383  x86 sys_modify_ldt wrapper crashes on bad ptr
 369402  Bad set/get_thread_area pointer crashes valgrind
+369441  bad lvec argument crashes process_vm_readv/writev syscall wrappers
 
 n-i-bz Fix incorrect (or infinite loop) unwind on RHEL7 x86 and amd64
 n-i-bz massif --pages-as-heap=yes does not report peak caused by mmap+munmap

diff --git a/coregrind/m_syswrap/syswrap-linux.c b/coregrind/m_syswrap/syswrap-linux.c
index e53de6c9858368bbbf05879751f1c448f270ac62..115922307a7eed8b8a32514e8dccdabfcc8e55c1 100644 (file)
--- a/coregrind/m_syswrap/syswrap-linux.c
+++ b/coregrind/m_syswrap/syswrap-linux.c
@@ -5004,8 +5004,8 @@ PRE(sys_process_vm_readv)
                  ARG2, ARG3 * sizeof(struct vki_iovec) );
    PRE_MEM_READ( "process_vm_readv(rvec)",
                  ARG4, ARG5 * sizeof(struct vki_iovec) );
-   if (ARG2 != 0) {
-      /* TODO: Don't do any of the following if lvec is invalid */
+   if (ARG2 != 0
+       && ML_(safe_to_deref) ((void *)ARG2, sizeof(struct vki_iovec) * ARG3)) {
       const struct vki_iovec *vec = (const struct vki_iovec *)ARG2;
       UInt i;
       for (i = 0; i < ARG3; i++)
@@ -5042,8 +5042,8 @@ PRE(sys_process_vm_writev)
                  ARG2, ARG3 * sizeof(struct vki_iovec) );
    PRE_MEM_READ( "process_vm_writev(rvec)",
                  ARG4, ARG5 * sizeof(struct vki_iovec) );
-   if (ARG2 != 0) {
-      /* TODO: Don't do any of the following if lvec is invalid */
+   if (ARG2 != 0
+       && ML_(safe_to_deref) ((void *)ARG2, sizeof(struct vki_iovec) * ARG3)) {
       const struct vki_iovec *vec = (const struct vki_iovec *)ARG2;
       UInt i;
       for (i = 0; i < ARG3; i++)