tree c02e26f4be0788d39acc12b0399b36d902b9cd53
parent 1e1d926369545ea09c98c6c7f5d109aa4ee0cd0b
author Jann Horn <jannh@google.com> 1559438158 +0200
committer Linus Torvalds <torvalds@linux-foundation.org> 1559931066 -0700

x86/insn-eval: Fix use-after-free access to LDT entry

get_desc() computes a pointer into the LDT while holding a lock that
protects the LDT from being freed, but then drops the lock and returns the
(now potentially dangling) pointer to its caller.

Fix it by giving the caller a copy of the LDT entry instead.

Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>