x86/insn-eval: Fix use-after-free access to LDT entry
authorJann Horn <jannh@google.com>
Sun, 2 Jun 2019 01:15:58 +0000 (03:15 +0200)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 7 Jun 2019 18:11:06 +0000 (11:11 -0700)
commitde9f869616dd95e95c00bdd6b0fcd3421e8a4323
treec02e26f4be0788d39acc12b0399b36d902b9cd53
parent1e1d926369545ea09c98c6c7f5d109aa4ee0cd0b
x86/insn-eval: Fix use-after-free access to LDT entry

get_desc() computes a pointer into the LDT while holding a lock that
protects the LDT from being freed, but then drops the lock and returns the
(now potentially dangling) pointer to its caller.

Fix it by giving the caller a copy of the LDT entry instead.

Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
arch/x86/lib/insn-eval.c