The patch titled
Subject: kcov: fix potential use-after-free in kcov_remote_start
has been added to the -mm tree. Its filename is
kcov-fix-potential-use-after-free-in-kcov_remote_start.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/kcov-fix-potential-use-after-free-in-kcov_remote_start.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/kcov-fix-potential-use-after-free-in-kcov_remote_start.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Andrey Konovalov <andreyknvl@xxxxxxxxx>
Subject: kcov: fix potential use-after-free in kcov_remote_start
If vmalloc() fails in kcov_remote_start() we'll access remote->kcov
without holding kcov_remote_lock, so remote might potentially be freed at
that point. Cache kcov pointer in a local variable.
Link: http://lkml.kernel.org/r/de0d3d30ff90776a2a509cc34c7c1c7521bda125.1584655448.git.andreyknvl@xxxxxxxxxx
Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Cc: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Cc: Marco Elver <elver@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
kernel/kcov.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/kernel/kcov.c~kcov-fix-potential-use-after-free-in-kcov_remote_start
+++ a/kernel/kcov.c
@@ -748,6 +748,7 @@ static const struct file_operations kcov
void kcov_remote_start(u64 handle)
{
struct kcov_remote *remote;
+ struct kcov *kcov;
void *area;
struct task_struct *t;
unsigned int size;
@@ -774,16 +775,17 @@ void kcov_remote_start(u64 handle)
spin_unlock(&kcov_remote_lock);
return;
}
+ kcov = remote->kcov;
/* Put in kcov_remote_stop(). */
- kcov_get(remote->kcov);
- t->kcov = remote->kcov;
+ kcov_get(kcov);
+ t->kcov = kcov;
/*
* Read kcov fields before unlock to prevent races with
* KCOV_DISABLE / kcov_remote_reset().
*/
- size = remote->kcov->remote_size;
- mode = remote->kcov->mode;
- sequence = remote->kcov->sequence;
+ size = kcov->remote_size;
+ mode = kcov->mode;
+ sequence = kcov->sequence;
area = kcov_remote_area_get(size);
spin_unlock(&kcov_remote_lock);
@@ -791,7 +793,7 @@ void kcov_remote_start(u64 handle)
area = vmalloc(size * sizeof(unsigned long));
if (!area) {
t->kcov = NULL;
- kcov_put(remote->kcov);
+ kcov_put(kcov);
return;
}
}
_
Patches currently in -mm which might be from andreyknvl@xxxxxxxxx are
kcov-fix-potential-use-after-free-in-kcov_remote_start.patch
kcov-move-t-kcov-assignments-into-kcov_start-stop.patch
kcov-move-t-kcov_sequence-assignment.patch
kcov-use-t-kcov_mode-as-enabled-indicator.patch
