lwp: copy timeout into kernel space in sys_select()

sys_select() passed the raw user-space timeout pointer straight
through to select(), unlike readfds/writefds/exceptfds which are
all validated with lwp_user_accessable() and copied into kernel
memory first. A malicious or buggy user thread could pass a
timeout pointing at unmapped or otherwise invalid memory, which
select() would then dereference directly (timeout->tv_sec /
timeout->tv_usec) without any check, from kernel context.

Validate and copy it into a kernel-local struct timeval the same
way the fd_set arguments already are, before it reaches select().

Fixes #10298

Signed-off-by: yi chen <[email protected]>

0 files changed, 0 insertions, 0 deletions