linux-user: properly check flags in openat2
target_to_host_bitmask truncates the bitmask to int. Check that the upper half of the flags do not have any bits set. Signed-off-by: Andreas Schwab <schwab@suse.de> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de>
Andreas Schwab committed
Feb 10, 2026 at 10:26 UTC
2cf1cb3363c9bdc03afbb3984279d324fe433e3c
1 file changed
+4
linux-user/syscall.c
+4
@@ -8831,6 +8831,10 @@ static int do_openat2(CPUArchState *cpu_env, abi_long dirfd,
8831
}
8832
return ret;
8833
}
8834
+ if (tswap64(how.flags) >> 32) {
8835
+ return -TARGET_EINVAL;
8836
+ }
8837
+
8838
pathname = lock_user_string(guest_pathname);
8839
if (!pathname) {
8840
return -TARGET_EFAULT;