aboutsummaryrefslogtreecommitdiff
path: root/arch/arm/kernel
diff options
context:
space:
mode:
authorAl Viro <viro@ZenIV.linux.org.uk>2012-12-16 00:25:57 +0000
committerBen Hutchings <ben@decadent.org.uk>2013-01-03 03:33:44 +0000
commit2c255ea98d0c54dd1d4ca021de81f2f5d90993d9 (patch)
treed0a67abc8ec2838e2b2e348dc26130dc162fff30 /arch/arm/kernel
parent3ee38c11281143f565f5bf1c947072a1bea06486 (diff)
ARM: missing ->mmap_sem around find_vma() in swp_emulate.c
commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream. find_vma() is *not* safe when somebody else is removing vmas. Not just the return value might get bogus just as you are getting it (this instance doesn't try to dereference the resulting vma), the search itself can get buggered in rather spectacular ways. IOW, ->mmap_sem really, really is not optional here. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'arch/arm/kernel')
-rw-r--r--arch/arm/kernel/swp_emulate.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/arch/arm/kernel/swp_emulate.c b/arch/arm/kernel/swp_emulate.c
index 5f452f8fde0..5d9b1eeecfd 100644
--- a/arch/arm/kernel/swp_emulate.c
+++ b/arch/arm/kernel/swp_emulate.c
@@ -108,10 +108,12 @@ static void set_segfault(struct pt_regs *regs, unsigned long addr)
{
siginfo_t info;
+ down_read(&current->mm->mmap_sem);
if (find_vma(current->mm, addr) == NULL)
info.si_code = SEGV_MAPERR;
else
info.si_code = SEGV_ACCERR;
+ up_read(&current->mm->mmap_sem);
info.si_signo = SIGSEGV;
info.si_errno = 0;