lkml.org 
[lkml]   [2020]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] net/9p: Validate current->sighand in client.c
Date
Fix rcu not being dereferenced cleanly by using the task
helpers (un)lock_task_sighand instead of spin_lock_irqsave and
spin_unlock_irqrestore to ensure current->sighand is a valid pointer as
suggested in the email referenced below.

Signed-off-by: Alexander Kapshuk <alexander.kapshuk@gmail.com>
Link: https://lore.kernel.org/lkml/20200618190807.GA20699@nautica/
---
net/9p/client.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/net/9p/client.c b/net/9p/client.c
index fc1f3635e5dd..15f16f2baa8f 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -787,9 +787,14 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
}
recalc_sigpending:
if (sigpending) {
- spin_lock_irqsave(&current->sighand->siglock, flags);
+ if (!lock_task_sighand(current, &flags)) {
+ pr_warn("%s (%d): current->sighand==NULL in recalc_sigpending\n",
+ __func__, task_pid_nr(current));
+ err = -ESRCH;
+ goto reterr;
+ }
recalc_sigpending();
- spin_unlock_irqrestore(&current->sighand->siglock, flags);
+ unlock_task_sighand(current, &flags);
}
if (err < 0)
goto reterr;
@@ -869,9 +874,14 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
}
recalc_sigpending:
if (sigpending) {
- spin_lock_irqsave(&current->sighand->siglock, flags);
+ if (!lock_task_sighand(current, &flags)) {
+ pr_warn("%s (%d): current->sighand==NULL in recalc_sigpending\n",
+ __func__, task_pid_nr(current));
+ err = -ESRCH;
+ goto reterr;
+ }
recalc_sigpending();
- spin_unlock_irqrestore(&current->sighand->siglock, flags);
+ unlock_task_sighand(current, &flags);
}
if (err < 0)
goto reterr;
--
2.27.0
\
 
 \ /
  Last update: 2020-06-21 15:54    [W:0.053 / U:0.636 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site