diff options
| author | Jann Horn <jannh@google.com> | 2019-06-02 03:15:58 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-06-07 11:11:06 -0700 |
| commit | de9f869616dd95e95c00bdd6b0fcd3421e8a4323 (patch) | |
| tree | c02e26f4be0788d39acc12b0399b36d902b9cd53 /kernel | |
| parent | 1e1d926369545ea09c98c6c7f5d109aa4ee0cd0b (diff) | |
x86/insn-eval: Fix use-after-free access to LDT entry
get_desc() computes a pointer into the LDT while holding a lock that
protects the LDT from being freed, but then drops the lock and returns the
(now potentially dangling) pointer to its caller.
Fix it by giving the caller a copy of the LDT entry instead.
Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions