diff options
| author | Jann Horn <jannh@google.com> | 2019-06-02 03:15:58 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-06-11 12:20:52 +0200 |
| commit | b598ddc7b9fc87b09bdadb63abf92b4ba46cd385 (patch) | |
| tree | 9c06b9ef789c0aa03f7224c58229afc3090a1aaa /arch/s390 | |
| parent | 4d166206cf418122ab01c4206b979d328e55e923 (diff) | |
| download | linux-rt-b598ddc7b9fc87b09bdadb63abf92b4ba46cd385.tar.gz | |
x86/insn-eval: Fix use-after-free access to LDT entry
commit de9f869616dd95e95c00bdd6b0fcd3421e8a4323 upstream.
get_desc() computes a pointer into the LDT while holding a lock that
protects the LDT from being freed, but then drops the lock and returns the
(now potentially dangling) pointer to its caller.
Fix it by giving the caller a copy of the LDT entry instead.
Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch/s390')
0 files changed, 0 insertions, 0 deletions