[patch 09/14] remap_file_pages protection support: fix race condition with concurrent faults on same address space

[blaisorblade]

From: Paolo 'Blaisorblade' Giarrusso <blaisorblade@xxxxxxxx>

The one noted by Hugh Dickins. A thread may get a fault because a PTE is absent,
then the PTE could be mapped by another thread, so we'd get a stale
pte_present(); we must check the permissions ourselves.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@xxxxxxxx>
Index: linux-2.6.git/mm/memory.c
===================================================================
--- linux-2.6.git.orig/mm/memory.c
+++ linux-2.6.git/mm/memory.c
@@ -2261,9 +2261,21 @@ static inline int handle_pte_fault(struc
 		goto unlock;
 
 	/* VM_MANYPROTS vma's have PTE's always installed with the correct
-	 * protection. So, generate a SIGSEGV if a fault is caught there. */
-	if (unlikely(vma->vm_flags & VM_MANYPROTS))
-		goto out_segv;
+	 * protection, so if we got a fault on a present PTE we're in trouble.
+	 * However, the pte_present() may simply be the result of a race
+	 * condition with another thread having already fixed the fault. So go
+	 * the slow way. */
+	if (unlikely(vma->vm_flags & VM_MANYPROTS)) {
+		pgprot_t pgprot = pte_to_pgprot(*pte);
+		pte_t test_entry = pfn_pte(0, pgprot);
+
+		if (unlikely((access_mask & VM_WRITE) && !pte_write(test_entry)))
+			goto out_segv;
+		if (unlikely((access_mask & VM_READ) && !pte_read(test_entry)))
+			goto out_segv;
+		if (unlikely((access_mask & VM_EXEC) && !pte_exec(test_entry)))
+			goto out_segv;
+	}
 
 	if (write_access) {
 		if (!pte_write(entry))

--
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade (Skype ID "PaoloGiarrusso", ICQ 215621894)
http://www.user-mode-linux.org/~blaisorblade
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/