lkml.org 
[lkml]   [2013]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] mm: fix use-after-free in sys_remap_file_pages
From: PaX Team <pageexec@freemail.hu>

http://lkml.org/lkml/2013/9/17/30

SyS_remap_file_pages() calls mmap_region(), which calls remove_vma_list(),
which calls remove_vma(), which frees the vma. Later (after out label)
SyS_remap_file_pages() accesses the freed vma in vm_flags = vma->vm_flags.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
---
mm/fremap.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/mm/fremap.c b/mm/fremap.c
index 5bff08147768..afad07b85ef2 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -218,6 +218,8 @@ get_write_lock:
BUG_ON(addr != start);
err = 0;
}
+ vm_flags = vma->vm_flags;
+ vma = NULL;
goto out;
}
mutex_lock(&mapping->i_mmap_mutex);
--
1.7.9.5

--
Kees Cook
Chrome OS Security


\
 
 \ /
  Last update: 2013-12-12 23:41    [W:0.900 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site