@samitouri / QOSamiQemu / commits / 2cf1cb3363

linux-user: properly check flags in openat2

target_to_host_bitmask truncates the bitmask to int. Check that the upper half of the flags do not have any bits set. Signed-off-by: Andreas Schwab <schwab@suse.de> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de>

Andreas Schwab committed Feb 10, 2026 at 10:26 UTC 2cf1cb3363c9bdc03afbb3984279d324fe433e3c
1 file changed +4
linux-user/syscall.c
+4
@@ -8831,6 +8831,10 @@ static int do_openat2(CPUArchState *cpu_env, abi_long dirfd,
8831 }
8832 return ret;
8833 }
8834 + if (tswap64(how.flags) >> 32) {
8835 + return -TARGET_EINVAL;
8836 + }
8837 +
8838 pathname = lock_user_string(guest_pathname);
8839 if (!pathname) {
8840 return -TARGET_EFAULT;