On Tue, Mar 20, 2018 at 10:48:48AM +0100, Geert Uytterhoeven wrote:
Hi Sasha,
On Mon, Mar 19, 2018 at 5:12 PM, Sasha Levin Alexander.Levin@microsoft.com wrote:
From: Michael Schmitz schmitzmic@gmail.com
[ Upstream commit 9dfa7bba35ac08a63565d58c454dccb7e1bb0a08 ]
get_reg() can be reentered on architectures with prioritized interrupts (m68k in this case), causing f->reg_index to be incremented after the range check. Out of bounds memory access past the pt_regs struct results. This will go mostly undetected unless access is beyond end of memory.
Prevent the race by disabling interrupts in get_reg().
Tested on m68k (Atari Falcon, and ARAnyM emulator).
Kudos to Geert Uytterhoeven for helping to trace this race.
Signed-off-by: Michael Schmitz schmitzmic@gmail.com Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Sasha Levin alexander.levin@microsoft.com
You probably want to apply follow-up commit 92e75428ffc90e2a ("random: use lockless method of accessing and updating f->reg_idx"), too.
I've grabbed it too, thanks!