[PATCH] nds32: Take mmap lock in cacheflush syscall

[Jann Horn]

We need to take the mmap lock around find_vma() and subsequent use of the
VMA. Otherwise, we can race with concurrent operations like munmap(), which
can lead to use-after-free accesses to freed VMAs.

Fixes: 1932fbe36e02 ("nds32: System calls handling")
Signed-off-by: Jann Horn <ja...@google.com>
---
To the maintainers:
I can't easily test this patch - I don't even have an nds32 compiler.
If you have tested this patch, you may want to add a CC stable tag to this.

 arch/nds32/kernel/sys_nds32.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/arch/nds32/kernel/sys_nds32.c b/arch/nds32/kernel/sys_nds32.c
index cb2d1e219bb3..836deecea83d 100644
--- a/arch/nds32/kernel/sys_nds32.c
+++ b/arch/nds32/kernel/sys_nds32.c
@@ -28,12 +28,18 @@ SYSCALL_DEFINE4(fadvise64_64_wrapper,int, fd, int,
advice, loff_t, offset,

 SYSCALL_DEFINE3(cacheflush, unsigned int, start, unsigned int, end, int, cache)
 {
+       struct mm_struct *mm = current->mm;
        struct vm_area_struct *vma;
        bool flushi = true, wbd = true;
+       int ret;

-       vma = find_vma(current->mm, start);
-       if (!vma)
-               return -EFAULT;
+       if (mmap_read_lock_killable(mm))
+               return -EINTR;
+       vma = find_vma(mm, start);
+       if (!vma) {
+               ret = -EFAULT;
+               goto out;
+       }
        switch (cache) {
        case ICACHE:
                wbd = false;
@@ -44,11 +50,15 @@ SYSCALL_DEFINE3(cacheflush, unsigned int, start,
unsigned int, end, int, cache)
        case BCACHE:
                break;
        default:
-               return -EINVAL;
+               ret = -EINVAL;
+               goto out;
        }
        cpu_cache_wbinval_range_check(vma, start, end, flushi, wbd);
+       ret = 0;

-       return 0;
+out:
+       mmap_read_unlock(mm);
+       return ret;
 }

 SYSCALL_DEFINE2(fp_udfiex_crtl, unsigned int, cmd, unsigned int, act)

base-commit: 6d28cf7dfede6cfca5119a0d415a6a447c68f3a0
-- 
2.28.0.681.g6f77f65b4e-goog