linux-kernel - [PATCH] secure unlock_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 21 Dec 2013 15:25:39 +0530
From:	naveen yadav <yad.naveen@...il.com>
To:	tj@...nel.org, Andrew Morton <akpm@...ux-foundation.org>,
	torvalds@...ux-foundation.org, linux-kernel@...r.kernel.org
Subject: [PATCH] secure unlock_task_sighand() call

Dear All,


When check code , we found below issue in zap_thread function().


>From 57bf616d0e20086d73122373baf799c675f4e3d5 Mon Sep 17 00:00:00 2001
From: Ajeet Yadav <ajeet.yadav.77@...il.com>
Date: Sat, 21 Dec 2013 14:45:48 +0530
Subject: [PATCH] secure unlock_task_sighand() call

Since the return value was not checked for lock_task_sighand(),
there was a chance that spin_unlock_irqrestore being called
from unlock_task_sighand gets called wihout actually acquire
the lock, which inturn can lead to kernel crash.

Signed-off-by: Ajeet Yadav <ajeet.yadav.77@...il.com>
Signed-off-by: Vaibhav Shinde <v.bhav.shinde@...il.com>

---
 fs/coredump.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/coredump.c b/fs/coredump.c
index 6d8b4cd..447b02c 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -357,9 +357,10 @@ static inline int zap_threads(struct task_struct
*tsk, struct mm_struct *mm,
                do {
                        if (p->mm) {
                                if (unlikely(p->mm == mm)) {
-                                       lock_task_sighand(p, &flags);
-                                       nr += zap_process(p, exit_code);
-                                       unlock_task_sighand(p, &flags);
+                                       if (lock_task_sighand(p, &flags) {
+                                               nr += zap_process(p, exit_code);
+                                               unlock_task_sighand(p, &flags);
+                                       }
                                }
                                break;
                        }
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/