linux-kernel - Re: [PATCH v4 2/7] kcov: fix potential use-after-free in kcov_remote

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+YMd1f_trERXGgcQgXa35cq33kfQd-Fv8_5G6V+XLbqTw@mail.gmail.com>
Date:   Thu, 4 Jun 2020 14:06:17 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Andrey Konovalov <andreyknvl@...gle.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Alan Stern <stern@...land.harvard.edu>,
        Andrew Morton <akpm@...ux-foundation.org>,
        USB list <linux-usb@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Alexander Potapenko <glider@...gle.com>,
        Marco Elver <elver@...gle.com>
Subject: Re: [PATCH v4 2/7] kcov: fix potential use-after-free in kcov_remote_start

On Thu, Mar 26, 2020 at 3:44 PM Andrey Konovalov <andreyknvl@...gle.com> wrote:
>
> If vmalloc() fails in kcov_remote_start() we'll access remote->kcov
> without holding kcov_remote_lock, so remote might potentially be freed
> at that point. Cache kcov pointer in a local variable.
>
> Signed-off-by: Andrey Konovalov <andreyknvl@...gle.com>

Reviewed-by: Dmitry Vyukov <dvyukov@...gle.com>

> ---
>  kernel/kcov.c | 14 ++++++++------
>  1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/kernel/kcov.c b/kernel/kcov.c
> index f6bd119c9419..cc5900ac2467 100644
> --- a/kernel/kcov.c
> +++ b/kernel/kcov.c
> @@ -748,6 +748,7 @@ static const struct file_operations kcov_fops = {
>  void kcov_remote_start(u64 handle)
>  {
>         struct kcov_remote *remote;
> +       struct kcov *kcov;
>         void *area;
>         struct task_struct *t;
>         unsigned int size;
> @@ -774,16 +775,17 @@ void kcov_remote_start(u64 handle)
>                 spin_unlock(&kcov_remote_lock);
>                 return;
>         }
> +       kcov = remote->kcov;
>         /* Put in kcov_remote_stop(). */
> -       kcov_get(remote->kcov);
> -       t->kcov = remote->kcov;
> +       kcov_get(kcov);
> +       t->kcov = kcov;
>         /*
>          * Read kcov fields before unlock to prevent races with
>          * KCOV_DISABLE / kcov_remote_reset().
>          */
> -       size = remote->kcov->remote_size;
> -       mode = remote->kcov->mode;
> -       sequence = remote->kcov->sequence;
> +       size = kcov->remote_size;
> +       mode = kcov->mode;
> +       sequence = kcov->sequence;
>         area = kcov_remote_area_get(size);
>         spin_unlock(&kcov_remote_lock);
>
> @@ -791,7 +793,7 @@ void kcov_remote_start(u64 handle)
>                 area = vmalloc(size * sizeof(unsigned long));
>                 if (!area) {
>                         t->kcov = NULL;
> -                       kcov_put(remote->kcov);
> +                       kcov_put(kcov);
>                         return;
>                 }
>         }
> --
> 2.26.0.rc2.310.g2932bb562d-goog
>