diff options
| author |   kettenis <kettenis@openbsd.org> | 2016-07-13 15:57:35 +0000 |
|---|---|---|
| committer | kettenis <kettenis@openbsd.org> | 2016-07-13 15:57:35 +0000 |
| commit | b4e1c71261ee475034707c9fd945f4bfd49dc371 (patch) | |
| tree | 1d2b5db8b754fe206988480463659175e1abe628 /sys | |
| parent | remove <0 check for an unsigned variable (diff) | |
| download | wireguard-openbsd-b4e1c71261ee475034707c9fd945f4bfd49dc371.tar.xz wireguard-openbsd-b4e1c71261ee475034707c9fd945f4bfd49dc371.zip | |
Since mappings established using __MAP_NOFAIL will be converted into anonymous
memory if the file backing the mapping is truncated, we should check resource
limits. This prevents callers from triggering a kernel panic and a potential
integer overflow in the amap code by forcing the allocation of too many slots.
Based on an analysis from Jesse Hertz and Tim Newsham.
ok deraadt@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/uvm/uvm_mmap.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/uvm/uvm_mmap.c b/sys/uvm/uvm_mmap.c index e2d05d02fd5..66c5b81a1f3 100644 --- a/sys/uvm/uvm_mmap.c +++ b/sys/uvm/uvm_mmap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvm_mmap.c,v 1.134 2016/06/08 15:38:28 deraadt Exp $ */ +/* $OpenBSD: uvm_mmap.c,v 1.135 2016/07/13 15:57:35 kettenis Exp $ */ /* $NetBSD: uvm_mmap.c,v 1.49 2001/02/18 21:19:08 chs Exp $ */ /* @@ -521,7 +521,7 @@ sys_mmap(struct proc *p, void *v, register_t *retval) /* MAP_PRIVATE mappings can always write to */ maxprot |= PROT_WRITE; } - if ((flags & MAP_ANON) != 0 || + if ((flags & MAP_ANON) != 0 || (flags & __MAP_NOFAULT) == 0 || ((flags & MAP_PRIVATE) != 0 && (prot & PROT_WRITE) != 0)) { if (p->p_rlimit[RLIMIT_DATA].rlim_cur < size || p->p_rlimit[RLIMIT_DATA].rlim_cur - size < @@ -541,7 +541,7 @@ sys_mmap(struct proc *p, void *v, register_t *retval) is_anon: /* label for SunOS style /dev/zero */ - if ((flags & MAP_ANON) != 0 || + if ((flags & MAP_ANON) != 0 || (flags & __MAP_NOFAULT) == 0 || ((flags & MAP_PRIVATE) != 0 && (prot & PROT_WRITE) != 0)) { if (p->p_rlimit[RLIMIT_DATA].rlim_cur < size || p->p_rlimit[RLIMIT_DATA].rlim_cur - size < |