lkml.org 
[lkml]   [1998]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] small fix: drivers/char/mem.c
Hello,

In drivers/char/mem.c:read_zero, we have a case of code mucking with page
tables which isn't protected by the mmap semaphore. The patch below
(ancient & well tested, against 2.1.86, but applies to 2.1.109 w/fuzz)
fixes it.

-ben


Index: linux-2.1.86-mm/drivers/char/mem.c
diff -u linux-2.1.86-mm/drivers/char/mem.c:1.1.1.2 linux-2.1.86-mm/drivers/char/mem.c:1.2
--- linux-2.1.86-mm/drivers/char/mem.c:1.1.1.2 Mon Mar 2 22:28:42 1998
+++ linux-2.1.86-mm/drivers/char/mem.c Fri Mar 6 03:51:32 1998
@@ -260,12 +260,15 @@
struct vm_area_struct * vma;
unsigned long addr=(unsigned long)buf;

+ /* Oops, this was forgotten before. -ben */
+ down(&current->mm->mmap_sem);
+
/* For private mappings, just map in zero pages. */
for (vma = find_vma(current->mm, addr); vma; vma = vma->vm_next) {
unsigned long count;

if (vma->vm_start > addr || (vma->vm_flags & VM_WRITE) == 0)
- return size;
+ goto out_up;
if (vma->vm_flags & VM_SHARED)
break;
count = vma->vm_end - addr;
@@ -273,16 +276,18 @@
count = size;

flush_cache_range(current->mm, addr, addr + count);
- zap_page_range(current->mm, addr, count);
- zeromap_page_range(addr, count, PAGE_COPY);
+ zap_page_range(vma, addr, count);
+ zeromap_page_range(vma, addr, count, PAGE_COPY);
flush_tlb_range(current->mm, addr, addr + count);

size -= count;
buf += count;
addr += count;
if (size == 0)
- return 0;
+ goto out_up;
}
+
+ up(&current->mm->mmap_sem);

/* The shared case is hard. Lets do the conventional zeroing. */
do {
@@ -296,6 +301,9 @@
} while (size);

return size;
+out_up:
+ up(&current->mm->mmap_sem);
+ return size;
}

static ssize_t read_zero(struct file * file, char * buf,

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.029 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site