From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
To: gorcunov@openvz.org
Cc: keescook@chromium.org, linux-kernel@vger.kernel.org,
akpm@linux-foundation.org, ebiederm@xmission.com,
xemul@openvz.org, mtk.manpages@gmail.com, tj@kernel.org,
avagin@openvz.org, serge.hallyn@canonical.com,
xemul@parallels.com, segoon@openwall.com,
kamezawa.hiroyu@jp.fujitsu.com
Subject: Re: [RFC c/r 4/4] c/r: prctl: Extend PR_SET_MM to set up more mm_struct entries
Date: Fri, 27 Jan 2012 15:31:25 -0500 [thread overview]
Message-ID: <4F23099D.1090606@jp.fujitsu.com> (raw)
In-Reply-To: <20120127184351.GI11086@moon>
>>> +
>>> + case PR_SET_MM_AUXV:
>>> + if (arg4 > sizeof(mm->saved_auxv))
>>> + goto out;
>>> + up_read(&mm->mmap_sem);
>>> +
>>> + error = -EFAULT;
>>> + if (!copy_from_user(mm->saved_auxv, (const void __user *)addr, arg4))
>>> + error = 0;
>>> +
>>> + return error;
>>
>> Is the mmap_sem released here because of the copy_from_user()? Is it
>> still safe to write to saved_auxv?
>>
>
> At moment I believe yes (if only I'm not missing something), we poke this
> vector at elf loading procedure, so it's up to user to sync access to "own"
> saved_auxv and write sane values inside.
Think prctl(PR_SET_MM_AUXV) vs prctl(PR_SET_MM_AUXV) race. That might make to write corrupted value.
syscall should be atomic from a point of userland view.
next prev parent reply other threads:[~2012-01-27 20:30 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-27 17:53 [RFC c/r 0/4] [RFC c/r 0/@total@] A pile in c/r sake Cyrill Gorcunov
2012-01-27 17:53 ` [RFC c/r 1/4] fs, proc: Introduce /proc/<pid>/task/<tid>/children entry v9 Cyrill Gorcunov
2012-01-27 17:53 ` [RFC c/r 2/4] [RFC] syscalls, x86: Add __NR_kcmp syscall v7 Cyrill Gorcunov
2012-01-27 18:05 ` H. Peter Anvin
2012-01-27 18:11 ` Cyrill Gorcunov
2012-01-27 18:15 ` Andi Kleen
2012-01-27 18:24 ` Cyrill Gorcunov
2012-01-27 18:30 ` H. Peter Anvin
2012-01-28 17:19 ` Michael Kerrisk
2012-01-28 17:34 ` Cyrill Gorcunov
2012-01-28 17:36 ` Cyrill Gorcunov
2012-01-27 18:31 ` Andi Kleen
2012-01-27 18:40 ` Cyrill Gorcunov
2012-01-27 19:40 ` Andi Kleen
2012-01-27 20:55 ` Eric W. Biederman
2012-01-27 18:40 ` Eric W. Biederman
2012-01-27 18:45 ` Cyrill Gorcunov
2012-01-27 19:10 ` Cyrill Gorcunov
2012-01-27 19:37 ` Vasiliy Kulikov
2012-01-27 19:59 ` hpanvin@gmail.com
2012-01-27 20:07 ` Cyrill Gorcunov
2012-01-27 20:19 ` KOSAKI Motohiro
2012-01-27 20:33 ` Eric W. Biederman
2012-01-27 20:50 ` Cyrill Gorcunov
2012-01-27 21:19 ` Eric W. Biederman
2012-01-27 20:34 ` Glauber Costa
2012-01-27 20:37 ` H. Peter Anvin
2012-01-27 20:47 ` Cyrill Gorcunov
2012-01-27 17:53 ` [RFC c/r 3/4] c/r: procfs: add arg_start/end, env_start/end and exit_code members to /proc/$pid/stat Cyrill Gorcunov
2012-01-27 18:29 ` Kees Cook
2012-01-27 20:00 ` KOSAKI Motohiro
2012-01-27 20:10 ` Cyrill Gorcunov
2012-01-27 17:53 ` [RFC c/r 4/4] c/r: prctl: Extend PR_SET_MM to set up more mm_struct entries Cyrill Gorcunov
2012-01-27 18:37 ` Kees Cook
2012-01-27 18:43 ` Cyrill Gorcunov
2012-01-27 20:31 ` KOSAKI Motohiro [this message]
2012-01-27 20:28 ` KOSAKI Motohiro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F23099D.1090606@jp.fujitsu.com \
--to=kosaki.motohiro@jp.fujitsu.com \
--cc=akpm@linux-foundation.org \
--cc=avagin@openvz.org \
--cc=ebiederm@xmission.com \
--cc=gorcunov@openvz.org \
--cc=kamezawa.hiroyu@jp.fujitsu.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mtk.manpages@gmail.com \
--cc=segoon@openwall.com \
--cc=serge.hallyn@canonical.com \
--cc=tj@kernel.org \
--cc=xemul@openvz.org \
--cc=xemul@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome