| From 4f1bd6ece7ebb7ae650ac13263321d31128bd4a6 Mon Sep 17 00:00:00 2001 |
| From: Florian Weimer <fweimer@redhat.com> |
| Date: Tue, 1 Jun 2021 17:51:41 +0200 |
| Subject: [PATCH 10/10] Fix use of __pthread_attr_copy in mq_notify (bug 27896) |
| |
| __pthread_attr_copy can fail and does not initialize the attribute |
| structure in that case. |
| |
| If __pthread_attr_copy is never called and there is no allocated |
| attribute, pthread_attr_destroy should not be called, otherwise |
| there is a null pointer dereference in rt/tst-mqueue6. |
| |
| Fixes commit 42d359350510506b87101cf77202fefcbfc790cb |
| ("Use __pthread_attr_copy in mq_notify (bug 27896)"). |
| |
| Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> |
| [Adrian: Backported CVE-2021-33574 to v2.33] |
| Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> |
| --- |
| sysdeps/unix/sysv/linux/mq_notify.c | 11 +++++++++-- |
| 1 file changed, 9 insertions(+), 2 deletions(-) |
| |
| diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c |
| index f404acfdfe..b5a903c3a2 100644 |
| --- a/sysdeps/unix/sysv/linux/mq_notify.c |
| +++ b/sysdeps/unix/sysv/linux/mq_notify.c |
| @@ -258,7 +258,14 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) |
| if (data.attr == NULL) |
| return -1; |
| |
| - __pthread_attr_copy (data.attr, notification->sigev_notify_attributes); |
| + int ret = __pthread_attr_copy (data.attr, |
| + notification->sigev_notify_attributes); |
| + if (ret != 0) |
| + { |
| + free (data.attr); |
| + __set_errno (ret); |
| + return -1; |
| + } |
| } |
| |
| /* Construct the new request. */ |
| @@ -271,7 +278,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) |
| int retval = INLINE_SYSCALL (mq_notify, 2, mqdes, &se); |
| |
| /* If it failed, free the allocated memory. */ |
| - if (__glibc_unlikely (retval != 0)) |
| + if (retval != 0 && data.attr != NULL) |
| { |
| pthread_attr_destroy (data.attr); |
| free (data.attr); |
| -- |
| 2.31.1 |
| |
