linux-kernel - [PATCH] nds32: Take mmap lock in cacheflush syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAG48ez1UnQEMok9rqFQC4XHBaMmBe=eaedu8Z_RXdjFHTna_LA@mail.gmail.com>
Date:   Fri, 25 Sep 2020 15:57:48 -0700
From:   Jann Horn <jannh@...gle.com>
To:     Nick Hu <nickhu@...estech.com>, Greentime Hu <green.hu@...il.com>,
        Vincent Chen <deanbo422@...il.com>
Cc:     linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: [PATCH] nds32: Take mmap lock in cacheflush syscall

We need to take the mmap lock around find_vma() and subsequent use of the
VMA. Otherwise, we can race with concurrent operations like munmap(), which
can lead to use-after-free accesses to freed VMAs.

Fixes: 1932fbe36e02 ("nds32: System calls handling")
Signed-off-by: Jann Horn <jannh@...gle.com>
---
To the maintainers:
I can't easily test this patch - I don't even have an nds32 compiler.
If you have tested this patch, you may want to add a CC stable tag to this.

 arch/nds32/kernel/sys_nds32.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/arch/nds32/kernel/sys_nds32.c b/arch/nds32/kernel/sys_nds32.c
index cb2d1e219bb3..836deecea83d 100644
--- a/arch/nds32/kernel/sys_nds32.c
+++ b/arch/nds32/kernel/sys_nds32.c
@@ -28,12 +28,18 @@ SYSCALL_DEFINE4(fadvise64_64_wrapper,int, fd, int,
advice, loff_t, offset,

 SYSCALL_DEFINE3(cacheflush, unsigned int, start, unsigned int, end, int, cache)
 {
+	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
 	bool flushi = true, wbd = true;
+	int ret;

-	vma = find_vma(current->mm, start);
-	if (!vma)
-		return -EFAULT;
+	if (mmap_read_lock_killable(mm))
+		return -EINTR;
+	vma = find_vma(mm, start);
+	if (!vma) {
+		ret = -EFAULT;
+		goto out;
+	}
 	switch (cache) {
 	case ICACHE:
 		wbd = false;
@@ -44,11 +50,15 @@ SYSCALL_DEFINE3(cacheflush, unsigned int, start,
unsigned int, end, int, cache)
 	case BCACHE:
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 	cpu_cache_wbinval_range_check(vma, start, end, flushi, wbd);
+	ret = 0;

-	return 0;
+out:
+	mmap_read_unlock(mm);
+	return ret;
 }

 SYSCALL_DEFINE2(fp_udfiex_crtl, unsigned int, cmd, unsigned int, act)

base-commit: 6d28cf7dfede6cfca5119a0d415a6a447c68f3a0
-- 
2.28.0.681.g6f77f65b4e-goog