Przeglądaj źródła

Kernel: Disown shared buffers on sys$execve()

When committing to a new executable, disown any shared buffers that the
process was previously co-owning.

Otherwise accessing the same shared buffer ID from the new program
would cause the kernel to find a cached (and stale!) reference to the
previous program's VM region corresponding to that shared buffer,
leading to a Region* use-after-free.

Fixes #1270.
Andreas Kling 5 lat temu
rodzic
commit
fc5ebe2a50
1 zmienionych plików z 2 dodań i 0 usunięć
  1. 2 0
      Kernel/Process.cpp

+ 2 - 0
Kernel/Process.cpp

@@ -952,6 +952,8 @@ int Process::do_exec(NonnullRefPtr<FileDescription> main_program_description, Ve
 
     m_futex_queues.clear();
 
+    disown_all_shared_buffers();
+
     for (int i = 0; i < m_fds.size(); ++i) {
         auto& daf = m_fds[i];
         if (daf.description && daf.flags & FD_CLOEXEC) {