lkml.org 
[lkml]   [2012]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC c/r 4/4] c/r: prctl: Extend PR_SET_MM to set up more mm_struct entries
>>> +
>>> + case PR_SET_MM_AUXV:
>>> + if (arg4 > sizeof(mm->saved_auxv))
>>> + goto out;
>>> + up_read(&mm->mmap_sem);
>>> +
>>> + error = -EFAULT;
>>> + if (!copy_from_user(mm->saved_auxv, (const void __user *)addr, arg4))
>>> + error = 0;
>>> +
>>> + return error;
>>
>> Is the mmap_sem released here because of the copy_from_user()? Is it
>> still safe to write to saved_auxv?
>>
>
> At moment I believe yes (if only I'm not missing something), we poke this
> vector at elf loading procedure, so it's up to user to sync access to "own"
> saved_auxv and write sane values inside.

Think prctl(PR_SET_MM_AUXV) vs prctl(PR_SET_MM_AUXV) race. That might make to write corrupted value.
syscall should be atomic from a point of userland view.


\
 
 \ /
  Last update: 2012-01-27 21:33    [W:0.036 / U:3.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site