diff options
| author |   visa <visa@openbsd.org> | 2019-02-03 05:33:48 +0000 |
|---|---|---|
| committer | visa <visa@openbsd.org> | 2019-02-03 05:33:48 +0000 |
| commit | b63d56553724b363983ac33ea336ed8b10ca41d5 (patch) | |
| tree | 9cf141dfb06d5055019163315ee75130f982a432 /sys/uvm | |
| parent | _dl_cerror is trivial on powerpc; just inline the handling into the stubs (diff) | |
| download | wireguard-openbsd-b63d56553724b363983ac33ea336ed8b10ca41d5.tar.xz wireguard-openbsd-b63d56553724b363983ac33ea336ed8b10ca41d5.zip | |
Always refault if relocking maps fails after IO. This fixes a regression
introduced with __MAP_NOFAULT. The regression let uvm_fault() run
without proper locking and rechecking of state after map version change
if page zero-fill was chosen.
OK kettenis@ deraadt@
Reported-by: syzbot+9972088c1026668c6c5c@syzkaller.appspotmail.com
Diffstat (limited to 'sys/uvm')
| -rw-r--r-- | sys/uvm/uvm_fault.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/uvm/uvm_fault.c b/sys/uvm/uvm_fault.c index e94e28c1987..087fac7851c 100644 --- a/sys/uvm/uvm_fault.c +++ b/sys/uvm/uvm_fault.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvm_fault.c,v 1.94 2018/10/31 08:50:25 kettenis Exp $ */ +/* $OpenBSD: uvm_fault.c,v 1.95 2019/02/03 05:33:48 visa Exp $ */ /* $NetBSD: uvm_fault.c,v 1.51 2000/08/06 00:22:53 thorpej Exp $ */ /* @@ -1069,6 +1069,8 @@ Case2: UVM_PAGE_OWN(uobjpage, NULL); goto ReFault; } + if (locked == FALSE) + goto ReFault; /* * we have the data in uobjpage which is PG_BUSY |