Messages in this thread | | | Date | Fri, 27 Jan 2012 15:31:25 -0500 | From | KOSAKI Motohiro <> | Subject | Re: [RFC c/r 4/4] c/r: prctl: Extend PR_SET_MM to set up more mm_struct entries |
| |
>>> + >>> + case PR_SET_MM_AUXV: >>> + if (arg4 > sizeof(mm->saved_auxv)) >>> + goto out; >>> + up_read(&mm->mmap_sem); >>> + >>> + error = -EFAULT; >>> + if (!copy_from_user(mm->saved_auxv, (const void __user *)addr, arg4)) >>> + error = 0; >>> + >>> + return error; >> >> Is the mmap_sem released here because of the copy_from_user()? Is it >> still safe to write to saved_auxv? >> > > At moment I believe yes (if only I'm not missing something), we poke this > vector at elf loading procedure, so it's up to user to sync access to "own" > saved_auxv and write sane values inside.
Think prctl(PR_SET_MM_AUXV) vs prctl(PR_SET_MM_AUXV) race. That might make to write corrupted value. syscall should be atomic from a point of userland view.
| |