Skip to contentSkip to conversation

missing ->mmap_sem around find_vma() in swp_emulate.c

PATCH New Al Viro 3 participants 3 messages Dec 16, 2012 – Dec 20, 2012 Arm (32-bit)

lore
Share & tools
lore

Al Viro

author
#0 lore raw

PATCH 1/1 missing ->mmap_sem around find_vma() in swp_emulate.c

find_vma() is *not* safe when somebody else is removing vmas. Not just the return value might get bogus just as you are getting it (this instance doesn't try to dereference the resulting vma), the search itself can get buggered in rather spectacular ways. IOW, ->mmap_sem really, really is not optional here.

Signed-off-by Al Viro <[email protected]>

---

arch/arm/kernel/swp_emulate.c +2 -0
index df74518..ab1017b 100644
@@ -109,10 +109,12 @@ static void set_segfault(struct pt_regs *regs, unsigned long addr)
 {
 	siginfo_t info;
 
+	down_read(&current->mm->mmap_sem);
 	if (find_vma(current->mm, addr) == NULL)
 		info.si_code = SEGV_MAPERR;
 	else
 		info.si_code = SEGV_ACCERR;
+	up_read(&current->mm->mmap_sem);
 
 	info.si_signo = SIGSEGV;
 	info.si_errno = 0;
#1 lore raw

PATCH 1/1 missing ->mmap_sem around find_vma() in swp_emulate.c

Am 16.12.2012 01:25, schrieb Al Viro:

Quoted 15 lines

find_vma() is *not* safe when somebody else is removing vmas. Not just the return value might get bogus just as you are getting it (this instance doesn't try to dereference the resulting vma), the search itself can get buggered in rather spectacular ways. IOW, ->mmap_sem really, really is not optional here.

Signed-off-by Al Viro <[email protected]>

---

arch/arm/kernel/swp_emulate.c +0 -0
index df74518..ab1017b 100644
@@ -109,10 +109,12 @@ static void set_segfault(struct pt_regs *regs, unsigned long addr)
  {
  	siginfo_t info;

arch/arm/kernel/swp_emulate.c static void set_segfault(struct pt_regs *regs, unsigned long addr) · line 120

Quoted 10 lines
arch/arm/kernel/swp_emulate.c +2 -0
 
+	down_read(&current->mm->mmap_sem);
  	if (find_vma(current->mm, addr) == NULL)
  		info.si_code = SEGV_MAPERR;
  	else
  		info.si_code = SEGV_ACCERR;
+	up_read(&current->mm->mmap_sem);
 
  	info.si_signo = SIGSEGV;
  	info.si_errno = 0;

Any comment on this?

Thanks

Dirk

#2 lore raw

PATCH 1/1 missing ->mmap_sem around find_vma() in swp_emulate.c

Quoted 24 lines · Dirk Behme

Am 16.12.2012 01:25, schrieb Al Viro:

Quoted 23 lines

find_vma() is *not* safe when somebody else is removing vmas. Not just the return value might get bogus just as you are getting it (this instance doesn't try to dereference the resulting vma), the search itself can get buggered in rather spectacular ways. IOW, ->mmap_sem really, really is not optional here.

Signed-off-by Al Viro <[email protected]>

---

arch/arm/kernel/swp_emulate.c +2 -0
index df74518..ab1017b 100644
@@ -109,10 +109,12 @@ static void set_segfault(struct pt_regs *regs, unsigned long addr)
  {
  	siginfo_t info;
 
+	down_read(&current->mm->mmap_sem);
  	if (find_vma(current->mm, addr) == NULL)
  		info.si_code = SEGV_MAPERR;
  	else
  		info.si_code = SEGV_ACCERR;
+	up_read(&current->mm->mmap_sem);
Quoted 4 lines

arch/arm/kernel/swp_emulate.c static void set_segfault(struct pt_regs *regs, unsigned long addr) · line 120

Quoted 2 lines
arch/arm/kernel/swp_emulate.c +0 -0
  	info.si_signo = SIGSEGV;
  	info.si_errno = 0;

Any comment on this?

Any comment required on this? No, it's from Al Viro, which means it's (mostly) always correct. I'll look at merging it soon.