From: Andy Lutomirski <luto@kernel.org> To: x86@kernel.org Cc: Borislav Petkov <bp@alien8.de>, linux-kernel@vger.kernel.org, Brian Gerst <brgerst@gmail.com>, Jann Horn <jann@thejh.net>, Josh Poimboeuf <jpoimboe@redhat.com>, Andy Lutomirski <luto@kernel.org> Subject: [PATCH v2 6/8] lib/syscall: Pin the task stack in collect_syscall() Date: Thu, 15 Sep 2016 22:45:47 -0700 Message-ID: <0bfd8e6d4729c97745d3781a29610a33d0a8091d.1474003868.git.luto@kernel.org> (raw) In-Reply-To: <cover.1474003868.git.luto@kernel.org> In-Reply-To: <cover.1474003868.git.luto@kernel.org> This will avoid a potential read-after-free if collect_syscall() (e.g. /proc/PID/syscall) is called on an exiting task. Reported-by: Jann Horn <jann@thejh.net> Signed-off-by: Andy Lutomirski <luto@kernel.org> --- lib/syscall.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/lib/syscall.c b/lib/syscall.c index e30e03932480..63239e097b13 100644 --- a/lib/syscall.c +++ b/lib/syscall.c @@ -7,9 +7,19 @@ static int collect_syscall(struct task_struct *target, long *callno, unsigned long args[6], unsigned int maxargs, unsigned long *sp, unsigned long *pc) { - struct pt_regs *regs = task_pt_regs(target); - if (unlikely(!regs)) + struct pt_regs *regs; + + if (!try_get_task_stack(target)) { + /* Task has no stack, so the task isn't in a syscall. */ + *callno = -1; + return 0; + } + + regs = task_pt_regs(target); + if (unlikely(!regs)) { + put_task_stack(target); return -EAGAIN; + } *sp = user_stack_pointer(regs); *pc = instruction_pointer(regs); @@ -18,6 +28,7 @@ static int collect_syscall(struct task_struct *target, long *callno, if (*callno != -1L && maxargs > 0) syscall_get_arguments(target, regs, 0, maxargs, args); + put_task_stack(target); return 0; } -- 2.7.4
next prev parent reply index Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-09-16 5:45 [PATCH v2 0/8] thread_info cleanups and stack caching Andy Lutomirski 2016-09-16 5:45 ` [PATCH v2 1/8] x86/entry/64: Fix a minor comment rebase error Andy Lutomirski 2016-09-16 9:16 ` [tip:x86/asm] " tip-bot for Andy Lutomirski 2016-09-16 5:45 ` [PATCH v2 2/8] sched: Add try_get_task_stack() and put_task_stack() Andy Lutomirski 2016-09-16 9:16 ` [tip:x86/asm] sched/core: " tip-bot for Andy Lutomirski 2016-09-16 5:45 ` [PATCH v2 3/8] kthread: to_live_kthread() needs try_get_task_stack() Andy Lutomirski 2016-09-16 9:17 ` [tip:x86/asm] kthread: Pin the stack via try_get_task_stack()/put_task_stack() in to_live_kthread() function tip-bot for Oleg Nesterov 2016-09-16 5:45 ` [PATCH v2 4/8] x86/dumpstack: Pin the target stack when dumping it Andy Lutomirski 2016-09-16 9:17 ` [tip:x86/asm] " tip-bot for Andy Lutomirski 2016-09-16 11:55 ` Josh Poimboeuf 2016-09-16 12:28 ` Josh Poimboeuf 2016-09-16 12:57 ` Ingo Molnar 2016-09-16 13:05 ` [PATCH] x86/dumpstack: remove NULL task pointer convention Josh Poimboeuf 2016-09-16 5:45 ` [PATCH v2 5/8] x86/process: Pin the target stack in get_wchan() Andy Lutomirski 2016-09-16 9:18 ` [tip:x86/asm] " tip-bot for Andy Lutomirski 2016-09-16 5:45 ` Andy Lutomirski [this message] 2016-09-16 9:18 ` [tip:x86/asm] lib/syscall: Pin the task stack in collect_syscall() tip-bot for Andy Lutomirski 2016-09-16 5:45 ` [PATCH v2 7/8] sched: Free the stack early if CONFIG_THREAD_INFO_IN_TASK Andy Lutomirski 2016-09-16 9:19 ` [tip:x86/asm] sched/core: " tip-bot for Andy Lutomirski 2016-09-16 5:45 ` [PATCH v2 8/8] fork: Cache two thread stacks per cpu if CONFIG_VMAP_STACK is set Andy Lutomirski 2016-09-16 9:19 ` [tip:x86/asm] fork: Optimize task creation by caching two thread stacks per CPU if CONFIG_VMAP_STACK=y tip-bot for Andy Lutomirski
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=0bfd8e6d4729c97745d3781a29610a33d0a8091d.1474003868.git.luto@kernel.org \ --to=luto@kernel.org \ --cc=bp@alien8.de \ --cc=brgerst@gmail.com \ --cc=jann@thejh.net \ --cc=jpoimboe@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
LKML Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \ linux-kernel@vger.kernel.org public-inbox-index lkml Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git