From: Paolo 'Blaisorblade' Giarrusso <[email protected]>
The one noted by Hugh Dickins. A thread may get a fault because a PTE is absent,
then the PTE could be mapped by another thread, so we'd get a stale
pte_present(); we must check the permissions ourselves.
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <[email protected]>
Index: linux-2.6.git/mm/memory.c
===================================================================
--- linux-2.6.git.orig/mm/memory.c
+++ linux-2.6.git/mm/memory.c
@@ -2261,9 +2261,21 @@ static inline int handle_pte_fault(struc
goto unlock;
/* VM_MANYPROTS vma's have PTE's always installed with the correct
- * protection. So, generate a SIGSEGV if a fault is caught there. */
- if (unlikely(vma->vm_flags & VM_MANYPROTS))
- goto out_segv;
+ * protection, so if we got a fault on a present PTE we're in trouble.
+ * However, the pte_present() may simply be the result of a race
+ * condition with another thread having already fixed the fault. So go
+ * the slow way. */
+ if (unlikely(vma->vm_flags & VM_MANYPROTS)) {
+ pgprot_t pgprot = pte_to_pgprot(*pte);
+ pte_t test_entry = pfn_pte(0, pgprot);
+
+ if (unlikely((access_mask & VM_WRITE) && !pte_write(test_entry)))
+ goto out_segv;
+ if (unlikely((access_mask & VM_READ) && !pte_read(test_entry)))
+ goto out_segv;
+ if (unlikely((access_mask & VM_EXEC) && !pte_exec(test_entry)))
+ goto out_segv;
+ }
if (write_access) {
if (!pte_write(entry))
--
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade (Skype ID "PaoloGiarrusso", ICQ 215621894)
http://www.user-mode-linux.org/~blaisorblade
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
