sys_select() passed the raw user-space timeout pointer straight
through to select(), unlike readfds/writefds/exceptfds which are
all validated with lwp_user_accessable() and copied into kernel
memory first. A malicious or buggy user thread could pass a
timeout pointing at unmapped or otherwise invalid memory, which
select() would then dereference directly (timeout->tv_sec /
timeout->tv_usec) without any check, from kernel context.
Validate and copy it into a kernel-local struct timeval the same
way the fd_set arguments already are, before it reaches select().
Fixes#10298
Signed-off-by: yi chen <94xhn1@gmail.com>
yi chen
4fbdf331d1