We need to take the mmap lock around find_vma() and subsequent use of the
VMA. Otherwise, we can race with concurrent operations like munmap(), which
can lead to use-after-free accesses to freed VMAs.
Fixes: 1932fbe36e02 ("nds32: System calls handling")
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
---
To the maintainers:
I can't easily test this patch - I don't even have an nds32 compiler.
If you have tested this patch, you may want to add a CC stable tag to this.
arch/nds32/kernel/sys_nds32.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/arch/nds32/kernel/sys_nds32.c b/arch/nds32/kernel/sys_nds32.c
index cb2d1e219bb3..836deecea83d 100644
--- a/arch/nds32/kernel/sys_nds32.c
+++ b/arch/nds32/kernel/sys_nds32.c
@@ -28,12 +28,18 @@ SYSCALL_DEFINE4(fadvise64_64_wrapper,int, fd, int,
advice, loff_t, offset,
SYSCALL_DEFINE3(cacheflush, unsigned int, start, unsigned int, end, int, cache)
{
+ struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
bool flushi = true, wbd = true;
+ int ret;
- vma = find_vma(current->mm, start);
- if (!vma)
- return -EFAULT;
+ if (mmap_read_lock_killable(mm))
+ return -EINTR;
+ vma = find_vma(mm, start);
+ if (!vma) {
+ ret = -EFAULT;
+ goto out;
+ }
switch (cache) {
case ICACHE:
wbd = false;
@@ -44,11 +50,15 @@ SYSCALL_DEFINE3(cacheflush, unsigned int, start,
unsigned int, end, int, cache)
case BCACHE:
break;
default:
- return -EINVAL;
+ ret = -EINVAL;
+ goto out;
}
cpu_cache_wbinval_range_check(vma, start, end, flushi, wbd);
+ ret = 0;
- return 0;
+out:
+ mmap_read_unlock(mm);
+ return ret;
}
SYSCALL_DEFINE2(fp_udfiex_crtl, unsigned int, cmd, unsigned int, act)
base-commit: 6d28cf7dfede6cfca5119a0d415a6a447c68f3a0
--
2.28.0.681.g6f77f65b4e-goog
