RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 09:38:11 +00:00
Code Issues Activity Actions

Kernel: Disable interrupts while looking into the thread table

Browse source 
There was a race window in a bunch of syscalls between calling
Thread::from_tid() and checking if the found thread was in the same
process as the calling thread.

If the found thread object was destroyed at that point, there was a
use-after-free that could be exploited by filling the kernel heap with
something that looked like a thread object.
This commit is contained in:
Andreas Kling 2020-01-27 13:48:54 +01:00
parent 17210a39e4
commit 638fe6f84a
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Kernel/Process.cpp
View file

@ -3633,6 +3633,7 @@ void Process::sys$exit_thread(void* exit_value)
int Process::sys$detach_thread(int tid)
{
REQUIRE_PROMISE(thread);
InterruptDisabler disabler;
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
return -ESRCH;
@ -3650,6 +3651,7 @@ int Process::sys$join_thread(int tid, void** exit_value)
if (exit_value && !validate_write_typed(exit_value))
return -EFAULT;
InterruptDisabler disabler;
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
return -ESRCH;
@ -3701,6 +3703,7 @@ int Process::sys$set_thread_name(int tid, const char* user_name, size_t user_nam
if (name.length() > max_thread_name_size)
return -EINVAL;
InterruptDisabler disabler;
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
return -ESRCH;
@ -3717,6 +3720,7 @@ int Process::sys$get_thread_name(int tid, char* buffer, size_t buffer_size)
if (!validate_write(buffer, buffer_size))
return -EFAULT;
InterruptDisabler disabler;
auto* thread = Thread::from_tid(tid);
if (!thread || thread->pid() != pid())
return -ESRCH;