Code:  static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
 {
	struct desc_struct *desc;
 	unsigned long limit;
 	short sel;
 
	sel = get_segment_selector(regs, seg_reg_idx);
	if (sel < 0)
		return 0;

	if (user_64bit_mode(regs) || v8086_mode(regs))
		return -1L;

 	if (!sel)
 		return 0;
 
	desc = get_desc(sel);
	if (!desc)
 		return 0;
 
 	/*
	 * If the granularity bit is set, the limit is given in multiples
	 * of 4096. This also means that the 12 least significant bits are
 	 * not tested when checking the segment limits. In practice,
 	 * this means that the segment ends in (limit << 12) + 0xfff.
 	 */
	limit = get_desc_limit(desc);
	if (desc->g)
 		limit = (limit << 12) + 0xfff;
 
 	return limit;
}

Vulnerability Type: 
CWE ID: CWE-362
Summary: In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation.
Commit Message: x86/insn-eval: Fix use-after-free access to LDT entry

get_desc() computes a pointer into the LDT while holding a lock that
protects the LDT from being freed, but then drops the lock and returns the
(now potentially dangling) pointer to its caller.

Fix it by giving the caller a copy of the LDT entry instead.

Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>