getitimer and setitimer(which != ITIMER_REAL, previous) copy the result
out through the checked write in Signals.cpp; the fault test only
exercised ITIMER_REAL. Add getitimer(ITIMER_VIRTUAL) and
setitimer(ITIMER_VIRTUAL, zero, previous) with an unmapped pointer
expecting EFAULT, and the matching calls with a valid pointer.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
When process_vm_readv failed with anything but EFAULT (EPERM under a
seccomp filter, ENOSYS), GuestCopyIn_nid_no_patch fell back to a plain
memcpy, so the host dereferenced the unchecked guest pointer, the crash
the checked read exists to prevent. Throw as GuestCopyOut_nid_no_patch
does for process_vm_writev.
The test runs the call in a child process under a seccomp filter that
answers process_vm_readv with EPERM and expects the exception.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
GuestCopyIn_nid_no_patch fell through to a plain memcpy on macOS, so an
unreadable pointer was dereferenced in the host. Read with
mach_vm_read_overwrite and require KERN_SUCCESS and a full copy, the
mirror of the mach_vm_write branch in GuestCopyOut_nid_no_patch and of
CopyGuestBytes.
The test now also checks the order FreeBSD 11.4 uses in sys_setitimer
(sys/kern/kern_time.c:803-808): the new timer is set first and the old
value is copied out afterwards, so a failing copyout reports EFAULT and
leaves the timer armed. The macOS branch has not been run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Co-authored-by: AdnanKhan-ak47 <[email protected]>
These wrote their result through the caller's pointer in place, or read
the itimerval of setitimer without a check, so a pointer into unmapped
memory crashed the host. Build the result locally and copy it out with
the checked write (and read the setitimer value with a checked read),
failing with EFAULT as FreeBSD 11.4 does: copyout in sys_gettimeofday
(sys/kern/kern_time.c:646 and 651) and sys_getitimer (kern_time.c:745),
copyin (kern_time.c:803) and copyout (kern_time.c:808) in sys_setitimer.
getrlimit and getrusage are left to #8986 and #8988, which cover the same
family for those two calls.
Builds on fix/output-structs-efault, which adds GuestCopyOut_nid_no_patch.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
