lkml.org 
[lkml]   [2016]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 0/2] fix up {arg,env}_{start,end} vs prctl
    On Wed, Jan 06, 2016 at 06:02:27AM +0100, Mateusz Guzik wrote:
    > An unprivileged user can trigger an oops on a kernel with
    > CONFIG_CHECKPOINT_RESTORE.
    >
    > proc_pid_cmdline_read takes mmap_sem for reading and obtains args + env
    > start/end values. These get sanity checked as follows:
    > BUG_ON(arg_start > arg_end);
    > BUG_ON(env_start > env_end);
    >
    > These can be changed by prctl_set_mm. Turns out also takes the semaphore for
    > reading, effectively rendering it useless. This results in:

    Thanks a lot for catching it! You know I tried to escape taking sem
    for writing as long as I could so another option might be simply
    zap these BUG_ON and rather exit with -EINVAL. On the other hands
    modification under read-lock of course is not correct in terms
    of "general approach" but these members are special so I took
    a risk. Anyway,

    Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>

    Thanks again.


    \
     
     \ /
      Last update: 2016-01-07 11:21    [W:3.664 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site