Linus Torvalds 96679ed69d mm: make fixup_user_fault() check the vma access rights too ... commit 1b17844b29ae042576bea588164f2f1e9590a8bc upstream. fixup_user_fault() is used by the futex code when the direct user access fails, and the futex code wants it to either map in the page in a usable form or return an error. It relied on handle_mm_fault() to map the page, and correctly checked the error return from that, but while that does map the page, it doesn't actually guarantee that the page will be mapped with sufficient permissions to be then accessed. So do the appropriate tests of the vma access rights by hand. [ Side note: arguably handle_mm_fault() could just do that itself, but we have traditionally done it in the caller, because some callers - notably get_user_pages() - have been able to access pages even when they are mapped with PROT_NONE. Maybe we should re-visit that design decision, but in the meantime this is the minimal patch. ] Found by Dave Jones running his trinity tool. Reported-by: Dave Jones <davej@redhat.com> Acked-by: Hugh Dickins <hughd@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-06-07 13:25:29 -07:00
..
backing-dev.c	bdi: avoid oops on device removal	2014-04-26 17:15:35 -07:00
balloon_compaction.c
bootmem.c
bounce.c	mm/bounce.c: fix a regression where MS_SNAP_STABLE (stable pages snapshotting) was ignored	2013-10-13 16:08:33 -07:00
cleancache.c	mm: cleancache: clean up cleancache_enabled	2013-04-30 17:04:01 -07:00
compaction.c	mm/compaction: break out of loop on !PageBuddy in isolate_freepages_block	2014-03-23 21:38:18 -07:00
debug-pagealloc.c
dmapool.c
fadvise.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
failslab.c
filemap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
filemap_xip.c	lift sb_start_write() out of ->write()	2013-04-09 14:12:56 -04:00
fremap.c	mm: fix use-after-free in sys_remap_file_pages	2014-01-09 12:24:24 -08:00
frontswap.c	frontswap: fix incorrect zeroing and allocation size for frontswap_map	2013-06-12 16:29:46 -07:00
highmem.c
huge_memory.c	thp: fix copy_page_rep GPF by testing is_huge_zero_pmd once only	2014-01-25 08:27:12 -08:00
hugetlb.c	mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()	2014-05-30 21:52:12 -07:00
hugetlb_cgroup.c
hwpoison-inject.c
init-mm.c
internal.h	mm: accelerate munlock() treatment of THP pages	2013-02-27 19:10:09 -08:00
interval_tree.c
Kconfig	mmKconfig: add an option to disable bounce	2013-04-29 15:54:40 -07:00
Kconfig.debug
kmemcheck.c
kmemleak-test.c
kmemleak.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
ksm.c	mm: close PageTail race	2014-04-03 12:01:05 -07:00
maccess.c
madvise.c	mm: madvise: complete input validation before taking lock	2013-04-29 15:54:37 -07:00
Makefile	memcg: add memory.pressure_level events	2013-04-29 15:54:38 -07:00
memblock.c	memblock: fix missing comment of memblock_insert_region()	2013-04-29 15:54:38 -07:00
memcontrol.c	memcg: reparent charges of children before processing parent	2014-03-23 21:38:20 -07:00
memory-failure.c	mm: close PageTail race	2014-04-03 12:01:05 -07:00
memory.c	mm: make fixup_user_fault() check the vma access rights too	2014-06-07 13:25:29 -07:00
memory_hotplug.c	mm/memory_hotplug.c: fix printk format warnings	2013-05-24 16:22:52 -07:00
mempolicy.c	mm/mempolicy.c: fix mempolicy printing in numa_maps	2014-02-06 11:08:12 -08:00
mempool.c
migrate.c	mm: numa: avoid unnecessary work on the failure path	2014-01-09 12:24:23 -08:00
mincore.c	swap: make each swap partition have one address_space	2013-02-23 17:50:17 -08:00
mlock.c	mm: try_to_unmap_cluster() should lock_page() before mlocking	2014-05-06 07:55:32 -07:00
mm_init.c	mm: init: report on last-nid information stored in page->flags	2013-02-23 17:50:18 -08:00
mmap.c	mm: ensure get_unmapped_area() returns higher address than mmap_min_addr	2013-12-04 10:56:39 -08:00
mmu_context.c	mm: remove old aio use_mm() comment	2013-05-07 18:38:27 -07:00
mmu_notifier.c	mm: mmu_notifier: re-fix freed page still mapped in secondary MMU	2013-05-24 16:22:51 -07:00
mmzone.c	mm: rename page struct field helpers	2013-02-23 17:50:18 -08:00
mprotect.c	mm: fix TLB flush race between migration, and change_protection_range	2014-01-09 12:24:23 -08:00
mremap.c	mm/rmap: rename anon_vma_unlock() => anon_vma_unlock_write()	2013-02-23 17:50:17 -08:00
msync.c
nobootmem.c	mm, nobootmem: do memset() after memblock_reserve()	2013-04-29 15:54:39 -07:00
nommu.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2013-05-01 07:21:43 -07:00
oom_kill.c	mm, oom: base root bonus on current usage	2014-02-13 13:48:02 -08:00
page-writeback.c	mm: __set_page_dirty_nobuffers() uses spin_lock_irqsave() instead of spin_lock_irq()	2014-02-20 11:06:11 -08:00
page_alloc.c	mm: close PageTail race	2014-04-03 12:01:05 -07:00
page_cgroup.c
page_io.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
page_isolation.c
pagewalk.c	mm/pagewalk.c: fix walk_page_range() access of wrong PTEs	2013-11-13 12:05:34 +09:00
percpu-km.c
percpu-vm.c
percpu.c
pgtable-generic.c	mm: fix TLB flush race between migration, and change_protection_range	2014-01-09 12:24:23 -08:00
process_vm_access.c	Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys	2013-03-12 11:05:45 -07:00
quicklist.c
readahead.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
rmap.c	mm: try_to_unmap_cluster() should lock_page() before mlocking	2014-05-06 07:55:32 -07:00
shmem.c	cope with potentially long ->d_dname() output for shmem/hugetlb	2013-10-18 07:45:45 -07:00
slab.c	slab: fix init_lock_keys	2013-07-21 18:21:26 -07:00
slab.h	memcg: check that kmem_cache has memcg_params before accessing it	2013-09-07 22:09:58 -07:00
slab_common.c	slab: prevent warnings when allocating with __GFP_NOWARN	2013-06-13 10:01:58 +03:00
slob.c	mm: rename page struct field helpers	2013-02-23 17:50:18 -08:00
slub.c	slub: Fix calculation of cpu slabs	2014-02-13 13:48:00 -08:00
sparse-vmemmap.c	sparse-vmemmap: specify vmemmap population range in bytes	2013-04-29 15:54:35 -07:00
sparse.c	mm, hotplug: avoid compiling memory hotremove functions when disabled	2013-04-29 15:54:37 -07:00
swap.c	mm: close PageTail race	2014-04-03 12:01:05 -07:00
swap_state.c	swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion	2013-06-12 16:29:45 -07:00
swapfile.c	frontswap: fix incorrect zeroing and allocation size for frontswap_map	2013-06-12 16:29:46 -07:00
truncate.c
util.c	swap: make each swap partition have one address_space	2013-02-23 17:50:17 -08:00
vmalloc.c	mm/vmalloc.c: fix an overflow bug in alloc_vmap_area()	2013-11-13 12:05:34 +09:00
vmpressure.c	memcg: add memory.pressure_level events	2013-04-29 15:54:38 -07:00
vmscan.c	mm/page-writeback.c: do not count anon pages as dirtyable memory	2014-02-13 13:48:00 -08:00
vmstat.c	mm: numa: return the number of base pages altered by protection changes	2013-12-08 07:29:27 -08:00