diff options
| author | Dean Deng <deandeng@google.com> | 2020-12-31 09:48:56 -0800 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-12-31 09:51:01 -0800 |
| commit | 807a080d9574e42dae83bb8bd0863b110b98a858 (patch) | |
| tree | f3aa355a50bc64fa8751ec3a533cf8265c4c37ab /pkg/sentry/syscalls/linux | |
| parent | 3b1d37f6ab5ca547020fdd573d3bf6a621313132 (diff) | |
Add missing error checks for FileDescription.Init.
Syzkaller discovered this bug in pipefs by doing something quite strange:
creat(&(0x7f0000002a00)='./file1\x00', 0x0)
mount(&(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='./file1\x00', &(0x7f0000000300)='devtmpfs\x00', 0x20000d, 0x0)
creat(&(0x7f0000000000)='./file1/file0\x00', 0x0)
This can be reproduced with:
touch mymount
mkfifo /dev/mypipe
mount -o ro -t devtmpfs devtmpfs mymount
echo 123 > mymount/mypipe
PiperOrigin-RevId: 349687714
Diffstat (limited to 'pkg/sentry/syscalls/linux')
| -rw-r--r-- | pkg/sentry/syscalls/linux/vfs2/pipe.go | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/pkg/sentry/syscalls/linux/vfs2/pipe.go b/pkg/sentry/syscalls/linux/vfs2/pipe.go index ee38fdca0..6986e39fe 100644 --- a/pkg/sentry/syscalls/linux/vfs2/pipe.go +++ b/pkg/sentry/syscalls/linux/vfs2/pipe.go @@ -42,7 +42,10 @@ func pipe2(t *kernel.Task, addr usermem.Addr, flags int32) error { if flags&^(linux.O_NONBLOCK|linux.O_CLOEXEC) != 0 { return syserror.EINVAL } - r, w := pipefs.NewConnectedPipeFDs(t, t.Kernel().PipeMount(), uint32(flags&linux.O_NONBLOCK)) + r, w, err := pipefs.NewConnectedPipeFDs(t, t.Kernel().PipeMount(), uint32(flags&linux.O_NONBLOCK)) + if err != nil { + return err + } defer r.DecRef(t) defer w.DecRef(t) |