mirror of
https://github.com/FEX-Emu/linux.git
synced 2024-12-05 06:39:27 +00:00
lib/syscall: Pin the task stack in collect_syscall()
This will avoid a potential read-after-free if collect_syscall() (e.g. /proc/PID/syscall) is called on an exiting task. Reported-by: Jann Horn <jann@thejh.net> Signed-off-by: Andy Lutomirski <luto@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/0bfd8e6d4729c97745d3781a29610a33d0a8091d.1474003868.git.luto@kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
parent
74327a3e88
commit
aa1f1a6396
@ -7,9 +7,19 @@ static int collect_syscall(struct task_struct *target, long *callno,
|
|||||||
unsigned long args[6], unsigned int maxargs,
|
unsigned long args[6], unsigned int maxargs,
|
||||||
unsigned long *sp, unsigned long *pc)
|
unsigned long *sp, unsigned long *pc)
|
||||||
{
|
{
|
||||||
struct pt_regs *regs = task_pt_regs(target);
|
struct pt_regs *regs;
|
||||||
if (unlikely(!regs))
|
|
||||||
|
if (!try_get_task_stack(target)) {
|
||||||
|
/* Task has no stack, so the task isn't in a syscall. */
|
||||||
|
*callno = -1;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
regs = task_pt_regs(target);
|
||||||
|
if (unlikely(!regs)) {
|
||||||
|
put_task_stack(target);
|
||||||
return -EAGAIN;
|
return -EAGAIN;
|
||||||
|
}
|
||||||
|
|
||||||
*sp = user_stack_pointer(regs);
|
*sp = user_stack_pointer(regs);
|
||||||
*pc = instruction_pointer(regs);
|
*pc = instruction_pointer(regs);
|
||||||
@ -18,6 +28,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
|
|||||||
if (*callno != -1L && maxargs > 0)
|
if (*callno != -1L && maxargs > 0)
|
||||||
syscall_get_arguments(target, regs, 0, maxargs, args);
|
syscall_get_arguments(target, regs, 0, maxargs, args);
|
||||||
|
|
||||||
|
put_task_stack(target);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user