summaryrefslogtreecommitdiffstats
path: root/arch/um
diff options
context:
space:
mode:
authorRichard Weinberger <richard@nod.at>2014-07-20 13:09:15 +0200
committerRichard Weinberger <richard@nod.at>2014-07-20 13:09:15 +0200
commit284e6d39516cc7f9fbceebb259849fcb41559a7b (patch)
treeb921cdd0911583d68e3de7fb48a9ef67b0883bd6 /arch/um
parentae5db6d12341684913a78b6537c0b9c22c999b5c (diff)
downloadlinux-stable-284e6d39516cc7f9fbceebb259849fcb41559a7b.tar.gz
linux-stable-284e6d39516cc7f9fbceebb259849fcb41559a7b.tar.bz2
linux-stable-284e6d39516cc7f9fbceebb259849fcb41559a7b.zip
um: Ensure that a stub page cannot get unmapped
Trinity discovered an execution path such that a task can unmap his stub page. Reported-by: Toralf Förster <toralf.foerster@gmx.de> Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'arch/um')
-rw-r--r--arch/um/kernel/tlb.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/um/kernel/tlb.c b/arch/um/kernel/tlb.c
index 9472079471bb..1fc619e5dfe9 100644
--- a/arch/um/kernel/tlb.c
+++ b/arch/um/kernel/tlb.c
@@ -124,6 +124,9 @@ static int add_munmap(unsigned long addr, unsigned long len,
struct host_vm_op *last;
int ret = 0;
+ if ((addr >= STUB_START) && (addr < STUB_END))
+ return -EINVAL;
+
if (hvc->index != 0) {
last = &hvc->ops[hvc->index - 1];
if ((last->type == MUNMAP) &&