Check align of value_ptr in futex syscalls
@@ -43,6 +43,9 @@ impl Syscall<'_> {
"futex.requeue: value_ptr={:?}, wake_count={:#x}, current_value={:#x}, requeue_ptr={:?}, requeue_count={:#x}, new_requeue_owner={:?}",
value_ptr, wake_count, current_value, requeue_ptr, requeue_count, new_requeue_owner
);
+ if value_ptr.is_null() || value_ptr.as_ptr() as usize % 4 != 0 {
+ return Err(ZxError::INVALID_ARGS);
+ }
let value = value_ptr.as_ref()?;
let requeue = requeue_ptr.as_ref()?;
if value_ptr.as_ptr() == requeue_ptr.as_ptr() {
@@ -68,6 +71,9 @@ impl Syscall<'_> {
pub fn sys_futex_wake(&self, value_ptr: UserInPtr<AtomicI32>, count: u32) -> ZxResult {
info!("futex.wake: value_ptr={:?}, count={:#x}", value_ptr, count);
+ if value_ptr.is_null() || value_ptr.as_ptr() as usize % 4 != 0 {
+ return Err(ZxError::INVALID_ARGS);
+ }
let value = value_ptr.as_ref()?;
let proc = self.thread.proc();
let futex = proc.get_futex(value);
@@ -77,6 +83,9 @@ impl Syscall<'_> {
pub fn sys_futex_wake_single_owner(&self, value_ptr: UserInPtr<AtomicI32>) -> ZxResult {
info!("futex.wake_single_owner: value_ptr={:?}", value_ptr);
+ if value_ptr.is_null() || value_ptr.as_ptr() as usize % 4 != 0 {
+ return Err(ZxError::INVALID_ARGS);
+ }
let value = value_ptr.as_ref()?;
let proc = self.thread.proc();
proc.get_futex(value).wake_single_owner();
