archive mirror
 help / color / mirror / Atom feed
* [PATCH] fix null dereference in sys_mprotect
@ 2002-09-25  2:18 Paul Mackerras
  0 siblings, 0 replies; only message in thread
From: Paul Mackerras @ 2002-09-25  2:18 UTC (permalink / raw)
  To: torvalds; +Cc: hch, linux-kernel


As it is at the moment, sys_mprotect will dereference a null pointer
if you use it on a region that is contained within the first vma.  I
have a little program that demonstrates this (I'll post it if anyone
is interested).  What happens then is that the process hangs in
do_page_fault at the down_read on the mm->mmap_sem, since sys_mprotect
has done a down_write on mm->mmap_sem.

The problem is that mprotect_fixup isn't updating prev properly.  Thus
we can finish the main loop in sys_mprotect with prev == NULL.  This
has been the case since Christoph's cleanups went in.  Prior to that,
mprotect_fixup always set prev to something non-NULL.  I suspect that
not updating prev could also cause vmas to get dropped completely if
the region being mprotected spans more than one vma.

The patch below fixes the problem by making mprotect_fixup set prev to
a reasonable value in all circumstances.


diff -urN linux-2.5/mm/mprotect.c pmac-2.5/mm/mprotect.c
--- linux-2.5/mm/mprotect.c	Wed Sep 18 15:42:48 2002
+++ pmac-2.5/mm/mprotect.c	Wed Sep 25 10:39:49 2002
@@ -193,6 +193,11 @@
 		if (error)
 			goto fail;
+	/*
+	 * Unless it returns an error, this function always sets *pprev to
+	 * the first vma for which vma->vm_end >= end.
+	 */
+	*pprev = vma;
 	if (end != vma->vm_end) {
 		error = split_vma(mm, vma, end, 0);

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2002-09-25  2:15 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2002-09-25  2:18 [PATCH] fix null dereference in sys_mprotect Paul Mackerras

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).