diff options
| author |   kettenis <kettenis@openbsd.org> | 2016-07-13 17:52:37 +0000 |
|---|---|---|
| committer | kettenis <kettenis@openbsd.org> | 2016-07-13 17:52:37 +0000 |
| commit | 99232cbaa222c3c4476222674bbeb72a7fbe7dfd (patch) | |
| tree | d7f65fa118932820f24b68f1d25b5f1486f578e9 /sys | |
| parent | Revert previous; the __MAP_NOFAULT test is inverted and the commit message is (diff) | |
| download | wireguard-openbsd-99232cbaa222c3c4476222674bbeb72a7fbe7dfd.tar.xz wireguard-openbsd-99232cbaa222c3c4476222674bbeb72a7fbe7dfd.zip | |
Since mappings established using __MAP_NOFAULT will be converted into anonymous
memory if the file backing the mapping is truncated, we should check resource
limits. This prevents callers from triggering a kernel panic and a potential
integer overflow in the amap code by forcing the allocation of too many slots.
Based on an analysis from Jesse Hertz and Tim Newsham.
ok deraadt@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/uvm/uvm_mmap.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/uvm/uvm_mmap.c b/sys/uvm/uvm_mmap.c index ac921faa0fa..242826a1061 100644 --- a/sys/uvm/uvm_mmap.c +++ b/sys/uvm/uvm_mmap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvm_mmap.c,v 1.136 2016/07/13 17:49:00 kettenis Exp $ */ +/* $OpenBSD: uvm_mmap.c,v 1.137 2016/07/13 17:52:37 kettenis Exp $ */ /* $NetBSD: uvm_mmap.c,v 1.49 2001/02/18 21:19:08 chs Exp $ */ /* @@ -521,7 +521,7 @@ sys_mmap(struct proc *p, void *v, register_t *retval) /* MAP_PRIVATE mappings can always write to */ maxprot |= PROT_WRITE; } - if ((flags & MAP_ANON) != 0 || + if ((flags & MAP_ANON) != 0 || (flags & __MAP_NOFAULT) != 0 || ((flags & MAP_PRIVATE) != 0 && (prot & PROT_WRITE) != 0)) { if (p->p_rlimit[RLIMIT_DATA].rlim_cur < size || p->p_rlimit[RLIMIT_DATA].rlim_cur - size < @@ -541,7 +541,7 @@ sys_mmap(struct proc *p, void *v, register_t *retval) is_anon: /* label for SunOS style /dev/zero */ - if ((flags & MAP_ANON) != 0 || + if ((flags & MAP_ANON) != 0 || (flags & __MAP_NOFAULT) != 0 || ((flags & MAP_PRIVATE) != 0 && (prot & PROT_WRITE) != 0)) { if (p->p_rlimit[RLIMIT_DATA].rlim_cur < size || p->p_rlimit[RLIMIT_DATA].rlim_cur - size < |