aboutsummaryrefslogtreecommitdiffstats
path: root/arch/arm
diff options
context:
space:
mode:
authorAl Viro <viro@ZenIV.linux.org.uk>2012-12-16 00:25:57 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-01-11 09:03:48 -0800
commit0b6916a71e85cd2e51c7cc3062814374a42753b9 (patch)
tree8babc03df584a1ddf89dbd4c6d675702bc2c4242 /arch/arm
parentf61019b8f7253ee77cebe22e9ff58865d16378a7 (diff)
downloadkernel_samsung_espresso10-0b6916a71e85cd2e51c7cc3062814374a42753b9.zip
kernel_samsung_espresso10-0b6916a71e85cd2e51c7cc3062814374a42753b9.tar.gz
kernel_samsung_espresso10-0b6916a71e85cd2e51c7cc3062814374a42753b9.tar.bz2
ARM: missing ->mmap_sem around find_vma() in swp_emulate.c
commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream. find_vma() is *not* safe when somebody else is removing vmas. Not just the return value might get bogus just as you are getting it (this instance doesn't try to dereference the resulting vma), the search itself can get buggered in rather spectacular ways. IOW, ->mmap_sem really, really is not optional here. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch/arm')
-rw-r--r--arch/arm/kernel/swp_emulate.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/arch/arm/kernel/swp_emulate.c b/arch/arm/kernel/swp_emulate.c
index 40ee7e5..0951a32 100644
--- a/arch/arm/kernel/swp_emulate.c
+++ b/arch/arm/kernel/swp_emulate.c
@@ -108,10 +108,12 @@ static void set_segfault(struct pt_regs *regs, unsigned long addr)
{
siginfo_t info;
+ down_read(&current->mm->mmap_sem);
if (find_vma(current->mm, addr) == NULL)
info.si_code = SEGV_MAPERR;
else
info.si_code = SEGV_ACCERR;
+ up_read(&current->mm->mmap_sem);
info.si_signo = SIGSEGV;
info.si_errno = 0;