lkml.org 
[lkml]   [2014]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch 1/2 -mm] prctl: PR_SET_MM_MAP -- Copy @auxv from userspace early
Oleg noticed that I'm doing a strange games with mm::mmap_sem
member -- I take it and keep busy whie validating data which
comes from user space but then I release it and copy auxv
data itself.

This means we've a small window where previously found VMAs might
be no longer valid thus move @auxv validation and copying at the
beginning of prctl_set_mm_map before we take the lock.

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
CC: Oleg Nesterov <oleg@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrew Vagin <avagin@openvz.org>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Julien Tinnes <jln@google.com>
---
kernel/sys.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)

Index: linux-2.6.git/kernel/sys.c
===================================================================
--- linux-2.6.git.orig/kernel/sys.c
+++ linux-2.6.git/kernel/sys.c
@@ -1838,22 +1838,28 @@ static int prctl_set_mm_map(int opt, con
if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
return -EFAULT;

- down_read(&mm->mmap_sem);
-
- if (validate_prctl_map_locked(&prctl_map))
- goto out;
-
+ /*
+ * Validate and copy auxv early to be able to keep
+ * @mmap_sem taken until this function ends.
+ */
if (prctl_map.auxv_size) {
- up_read(&mm->mmap_sem);
+ if (!prctl_map.auxv ||
+ prctl_map.auxv_size > sizeof(mm->saved_auxv))
+ return -EINVAL;
+
memset(user_auxv, 0, sizeof(user_auxv));
error = copy_from_user(user_auxv,
(const void __user *)prctl_map.auxv,
prctl_map.auxv_size);
- down_read(&mm->mmap_sem);
if (error)
goto out;
}

+ down_read(&mm->mmap_sem);
+
+ if (validate_prctl_map_locked(&prctl_map))
+ goto out;
+
if (prctl_map.exe_fd != (u32)-1) {
error = prctl_set_mm_exe_file_locked(mm, prctl_map.exe_fd);
if (error)


\
 
 \ /
  Last update: 2014-08-23 11:01    [W:0.033 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site