mirror of
https://github.com/RGBCube/serenity
synced 2025-07-24 21:27:44 +00:00
Kernel: Disable interrupts while looking into the thread table
There was a race window in a bunch of syscalls between calling Thread::from_tid() and checking if the found thread was in the same process as the calling thread. If the found thread object was destroyed at that point, there was a use-after-free that could be exploited by filling the kernel heap with something that looked like a thread object.
This commit is contained in:
parent
17210a39e4
commit
638fe6f84a
1 changed files with 4 additions and 0 deletions
|
@ -3633,6 +3633,7 @@ void Process::sys$exit_thread(void* exit_value)
|
||||||
int Process::sys$detach_thread(int tid)
|
int Process::sys$detach_thread(int tid)
|
||||||
{
|
{
|
||||||
REQUIRE_PROMISE(thread);
|
REQUIRE_PROMISE(thread);
|
||||||
|
InterruptDisabler disabler;
|
||||||
auto* thread = Thread::from_tid(tid);
|
auto* thread = Thread::from_tid(tid);
|
||||||
if (!thread || thread->pid() != pid())
|
if (!thread || thread->pid() != pid())
|
||||||
return -ESRCH;
|
return -ESRCH;
|
||||||
|
@ -3650,6 +3651,7 @@ int Process::sys$join_thread(int tid, void** exit_value)
|
||||||
if (exit_value && !validate_write_typed(exit_value))
|
if (exit_value && !validate_write_typed(exit_value))
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
|
||||||
|
InterruptDisabler disabler;
|
||||||
auto* thread = Thread::from_tid(tid);
|
auto* thread = Thread::from_tid(tid);
|
||||||
if (!thread || thread->pid() != pid())
|
if (!thread || thread->pid() != pid())
|
||||||
return -ESRCH;
|
return -ESRCH;
|
||||||
|
@ -3701,6 +3703,7 @@ int Process::sys$set_thread_name(int tid, const char* user_name, size_t user_nam
|
||||||
if (name.length() > max_thread_name_size)
|
if (name.length() > max_thread_name_size)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
||||||
|
InterruptDisabler disabler;
|
||||||
auto* thread = Thread::from_tid(tid);
|
auto* thread = Thread::from_tid(tid);
|
||||||
if (!thread || thread->pid() != pid())
|
if (!thread || thread->pid() != pid())
|
||||||
return -ESRCH;
|
return -ESRCH;
|
||||||
|
@ -3717,6 +3720,7 @@ int Process::sys$get_thread_name(int tid, char* buffer, size_t buffer_size)
|
||||||
if (!validate_write(buffer, buffer_size))
|
if (!validate_write(buffer, buffer_size))
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
|
||||||
|
InterruptDisabler disabler;
|
||||||
auto* thread = Thread::from_tid(tid);
|
auto* thread = Thread::from_tid(tid);
|
||||||
if (!thread || thread->pid() != pid())
|
if (!thread || thread->pid() != pid())
|
||||||
return -ESRCH;
|
return -ESRCH;
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue