diff options
| author | Jann Horn | 2018-06-25 18:34:10 +0200 |
|---|---|---|
| committer | Eric W. Biederman | 2018-08-11 09:05:53 +0200 |
| commit | 42a0cc3478584d4d63f68f2f5af021ddbea771fa (patch) | |
| tree | 8dc33625ea1c8488e01965f159ef3f597eba42cb /arch/sparc/kernel/sys_sparc_64.c | |
| parent | userns: move user access out of the mutex (diff) | |
| download | kernel-qcow2-linux-42a0cc3478584d4d63f68f2f5af021ddbea771fa.tar.gz kernel-qcow2-linux-42a0cc3478584d4d63f68f2f5af021ddbea771fa.tar.xz kernel-qcow2-linux-42a0cc3478584d4d63f68f2f5af021ddbea771fa.zip | |
sys: don't hold uts_sem while accessing userspace memory
Holding uts_sem as a writer while accessing userspace memory allows a
namespace admin to stall all processes that attempt to take uts_sem.
Instead, move data through stack buffers and don't access userspace memory
while uts_sem is held.
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'arch/sparc/kernel/sys_sparc_64.c')
| -rw-r--r-- | arch/sparc/kernel/sys_sparc_64.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c index 63baa8aa9414..274ed0b9b3e0 100644 --- a/arch/sparc/kernel/sys_sparc_64.c +++ b/arch/sparc/kernel/sys_sparc_64.c @@ -519,23 +519,27 @@ asmlinkage void sparc_breakpoint(struct pt_regs *regs) SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) { - int nlen, err; + int nlen, err; + char tmp[__NEW_UTS_LEN + 1]; if (len < 0) return -EINVAL; - down_read(&uts_sem); - + down_read(&uts_sem); + nlen = strlen(utsname()->domainname) + 1; err = -EINVAL; if (nlen > len) - goto out; + goto out_unlock; + memcpy(tmp, utsname()->domainname, nlen); + + up_read(&uts_sem); - err = -EFAULT; - if (!copy_to_user(name, utsname()->domainname, nlen)) - err = 0; + if (copy_to_user(name, tmp, nlen)) + return -EFAULT; + return 0; -out: +out_unlock: up_read(&uts_sem); return err; } |