nds32: Take mmap lock in cacheflush syscall

Commit Message

Jann Horn Sept. 25, 2020, 10:57 p.m. UTC

We need to take the mmap lock around find_vma() and subsequent use of the
VMA. Otherwise, we can race with concurrent operations like munmap(), which
can lead to use-after-free accesses to freed VMAs.

Fixes: 1932fbe36e02 ("nds32: System calls handling")
Signed-off-by: Jann Horn <[e-mail]>
---
To the maintainers:
I can't easily test this patch - I don't even have an nds32 compiler.
If you have tested this patch, you may want to add a CC stable tag to this.

 arch/nds32/kernel/sys_nds32.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

 		wbd = false;
@@ -44,11 +50,15 @@ SYSCALL_DEFINE3(cacheflush, unsigned int, start,
unsigned int, end, int, cache)
 	case BCACHE:
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 	cpu_cache_wbinval_range_check(vma, start, end, flushi, wbd);
+	ret = 0;

-	return 0;
+out:
+	mmap_read_unlock(mm);
+	return ret;
 }

 SYSCALL_DEFINE2(fp_udfiex_crtl, unsigned int, cmd, unsigned int, act)

base-commit: 6d28cf7dfede6cfca5119a0d415a6a447c68f3a0

Patch

diff --git a/arch/nds32/kernel/sys_nds32.c b/arch/nds32/kernel/sys_nds32.c
index cb2d1e219bb3..836deecea83d 100644
--- a/arch/nds32/kernel/sys_nds32.c
+++ b/arch/nds32/kernel/sys_nds32.c
@@ -28,12 +28,18 @@  SYSCALL_DEFINE4(fadvise64_64_wrapper,int, fd, int,
advice, loff_t, offset,

 SYSCALL_DEFINE3(cacheflush, unsigned int, start, unsigned int, end, int, cache)
 {
+	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
 	bool flushi = true, wbd = true;
+	int ret;

-	vma = find_vma(current->mm, start);
-	if (!vma)
-		return -EFAULT;
+	if (mmap_read_lock_killable(mm))
+		return -EINTR;
+	vma = find_vma(mm, start);
+	if (!vma) {
+		ret = -EFAULT;
+		goto out;
+	}
 	switch (cache) {
 	case ICACHE: