diff options
| author | Jann Horn <[email protected]> | 2019-06-02 03:15:58 +0200 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2019-06-07 11:11:06 -0700 |
| commit | de9f869616dd95e95c00bdd6b0fcd3421e8a4323 (patch) | |
| tree | c02e26f4be0788d39acc12b0399b36d902b9cd53 /lib/mpi/mpicoder.c | |
| parent | 1e1d926369545ea09c98c6c7f5d109aa4ee0cd0b (diff) | |
x86/insn-eval: Fix use-after-free access to LDT entry
get_desc() computes a pointer into the LDT while holding a lock that
protects the LDT from being freed, but then drops the lock and returns the
(now potentially dangling) pointer to its caller.
Fix it by giving the caller a copy of the LDT entry instead.
Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor")
Cc: [email protected]
Signed-off-by: Jann Horn <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'lib/mpi/mpicoder.c')
0 files changed, 0 insertions, 0 deletions