| From 92040c8c2cd1a408802bea57fb586ccbb7a59c15 Mon Sep 17 00:00:00 2001 |
| From: Andy Lutomirski <luto@kernel.org> |
| Date: Thu, 15 Sep 2016 22:45:47 -0700 |
| Subject: [PATCH] lib/syscall: Pin the task stack in collect_syscall() |
| |
| commit aa1f1a639621672b68f654dc815a7d8298ff396f upstream. |
| |
| This will avoid a potential read-after-free if collect_syscall() |
| (e.g. /proc/PID/syscall) is called on an exiting task. |
| |
| Reported-by: Jann Horn <jann@thejh.net> |
| Signed-off-by: Andy Lutomirski <luto@kernel.org> |
| Cc: Borislav Petkov <bp@alien8.de> |
| Cc: Brian Gerst <brgerst@gmail.com> |
| Cc: Denys Vlasenko <dvlasenk@redhat.com> |
| Cc: H. Peter Anvin <hpa@zytor.com> |
| Cc: Josh Poimboeuf <jpoimboe@redhat.com> |
| Cc: Linus Torvalds <torvalds@linux-foundation.org> |
| Cc: Peter Zijlstra <peterz@infradead.org> |
| Cc: Thomas Gleixner <tglx@linutronix.de> |
| Link: http://lkml.kernel.org/r/0bfd8e6d4729c97745d3781a29610a33d0a8091d.1474003868.git.luto@kernel.org |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| |
| diff --git a/lib/syscall.c b/lib/syscall.c |
| index e30e03932480..63239e097b13 100644 |
| --- a/lib/syscall.c |
| +++ b/lib/syscall.c |
| @@ -7,9 +7,19 @@ static int collect_syscall(struct task_struct *target, long *callno, |
| unsigned long args[6], unsigned int maxargs, |
| unsigned long *sp, unsigned long *pc) |
| { |
| - struct pt_regs *regs = task_pt_regs(target); |
| - if (unlikely(!regs)) |
| + struct pt_regs *regs; |
| + |
| + if (!try_get_task_stack(target)) { |
| + /* Task has no stack, so the task isn't in a syscall. */ |
| + *callno = -1; |
| + return 0; |
| + } |
| + |
| + regs = task_pt_regs(target); |
| + if (unlikely(!regs)) { |
| + put_task_stack(target); |
| return -EAGAIN; |
| + } |
| |
| *sp = user_stack_pointer(regs); |
| *pc = instruction_pointer(regs); |
| @@ -18,6 +28,7 @@ static int collect_syscall(struct task_struct *target, long *callno, |
| if (*callno != -1L && maxargs > 0) |
| syscall_get_arguments(target, regs, 0, maxargs, args); |
| |
| + put_task_stack(target); |
| return 0; |
| } |
| |
| -- |
| 2.15.0 |
| |