Explorar el Código

Kernel: Fix race in clock_nanosleep

This is a complete fix of clock_nanosleep, because the thread holds the
process lock again when returning from sleep()/sleep_until().
Therefore, no further concurrent invalidation can occur.
Ben Wiederhake hace 5 años
padre
commit
4dd4dd2f3c
Se han modificado 1 ficheros con 7 adiciones y 0 borrados
  1. 7 0
      Kernel/Process.cpp

+ 7 - 0
Kernel/Process.cpp

@@ -4290,6 +4290,13 @@ int Process::sys$clock_nanosleep(const Syscall::SC_clock_nanosleep_params* user_
         if (wakeup_time > g_uptime) {
             u32 ticks_left = wakeup_time - g_uptime;
             if (!is_absolute && params.remaining_sleep) {
+                if (!validate_write_typed(params.remaining_sleep)) {
+                    // This can happen because the lock is dropped while
+                    // sleeping, thus giving other threads the opportunity
+                    // to make the region unwritable.
+                    return -EFAULT;
+                }
+
                 timespec remaining_sleep;
                 memset(&remaining_sleep, 0, sizeof(timespec));
                 remaining_sleep.tv_sec = ticks_left / TICKS_PER_SECOND;