On Tue, 12 Dec 2017, Andy Lutomirski wrote:
> +
> +     return 0;
> +#else
> +     return -EINVAL;

Errm. What's the point of that? Breaking non PTI?

>       new_ldt = alloc_ldt_struct(old_mm->context.ldt->nr_entries);
>       if (!new_ldt) {
> @@ -155,8 +266,17 @@ int init_new_context_ldt(struct task_struct *tsk, struct 
> mm_struct *mm)
>       memcpy(new_ldt->entries, old_mm->context.ldt->entries,
>              new_ldt->nr_entries * LDT_ENTRY_SIZE);
>       finalize_ldt_struct(new_ldt);
> +     retval = map_ldt_struct(mm, new_ldt, 0);
> +     if (retval)
> +             goto out_free;
>  
>       mm->context.ldt = new_ldt;
> +     goto out_unlock;
> +
> +out_free:
> +     free_ldt_pgtables(mm);
> +     free_ldt_struct(new_ldt);
> +     return retval;

Leaks old_mm->context_lock;

Thanks,

        tglx

Reply via email to