Skip to content

Commit

Permalink
Kernel: Clear the region lookup cache on exec()
Browse files Browse the repository at this point in the history
Each process has a 1-level lookup cache for fast repeated lookups of
the same VM region (which tends to be the majority of lookups.)
The cache is used by the following syscalls: munmap, madvise, mprotect
and set_mmap_name.

After a succesful exec(), there could be a stale Region* in the lookup
cache, and the new executable was able to manipulate it using a number
of use-after-free code paths.
  • Loading branch information
awesomekling committed Feb 24, 2020
1 parent 5ce6215 commit 79576f9
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions Kernel/Process.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -952,6 +952,8 @@ int Process::do_exec(NonnullRefPtr<FileDescription> main_program_description, Ve

m_futex_queues.clear();

m_region_lookup_cache = {};

disown_all_shared_buffers();

for (int i = 0; i < m_fds.size(); ++i) {
Expand Down

0 comments on commit 79576f9

Please sign in to comment.