diff options
| author | Jann Horn <[email protected]> | 2019-06-02 01:15:58 +0000 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2019-06-07 18:11:06 +0000 |
| commit | de9f869616dd95e95c00bdd6b0fcd3421e8a4323 (patch) | |
| tree | c02e26f4be0788d39acc12b0399b36d902b9cd53 /lib/lockref.c | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (diff) | |
| download | kernel-de9f869616dd95e95c00bdd6b0fcd3421e8a4323.tar.gz kernel-de9f869616dd95e95c00bdd6b0fcd3421e8a4323.zip | |
x86/insn-eval: Fix use-after-free access to LDT entry
get_desc() computes a pointer into the LDT while holding a lock that
protects the LDT from being freed, but then drops the lock and returns the
(now potentially dangling) pointer to its caller.
Fix it by giving the caller a copy of the LDT entry instead.
Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor")
Cc: [email protected]
Signed-off-by: Jann Horn <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'lib/lockref.c')
0 files changed, 0 insertions, 0 deletions