lkml.org 
[lkml]   [2020]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
Subject[PATCH v4 2/7] kcov: fix potential use-after-free in kcov_remote_start
From
If vmalloc() fails in kcov_remote_start() we'll access remote->kcov
without holding kcov_remote_lock, so remote might potentially be freed
at that point. Cache kcov pointer in a local variable.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
kernel/kcov.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/kernel/kcov.c b/kernel/kcov.c
index f6bd119c9419..cc5900ac2467 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -748,6 +748,7 @@ static const struct file_operations kcov_fops = {
void kcov_remote_start(u64 handle)
{
struct kcov_remote *remote;
+ struct kcov *kcov;
void *area;
struct task_struct *t;
unsigned int size;
@@ -774,16 +775,17 @@ void kcov_remote_start(u64 handle)
spin_unlock(&kcov_remote_lock);
return;
}
+ kcov = remote->kcov;
/* Put in kcov_remote_stop(). */
- kcov_get(remote->kcov);
- t->kcov = remote->kcov;
+ kcov_get(kcov);
+ t->kcov = kcov;
/*
* Read kcov fields before unlock to prevent races with
* KCOV_DISABLE / kcov_remote_reset().
*/
- size = remote->kcov->remote_size;
- mode = remote->kcov->mode;
- sequence = remote->kcov->sequence;
+ size = kcov->remote_size;
+ mode = kcov->mode;
+ sequence = kcov->sequence;
area = kcov_remote_area_get(size);
spin_unlock(&kcov_remote_lock);

@@ -791,7 +793,7 @@ void kcov_remote_start(u64 handle)
area = vmalloc(size * sizeof(unsigned long));
if (!area) {
t->kcov = NULL;
- kcov_put(remote->kcov);
+ kcov_put(kcov);
return;
}
}
--
2.26.0.rc2.310.g2932bb562d-goog
\
 
 \ /
  Last update: 2020-03-26 15:45    [W:0.043 / U:1.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site