From 17df625c0f7b78bd5df88965b38213a909360b80 Mon Sep 17 00:00:00 2001 From: markj Date: Fri, 6 Dec 2019 23:39:08 +0000 Subject: [PATCH] Fix fault_type handling in vm_map_lookup(). Suppose that the map entry is wired, so that we later assign fault_type = entry->protection. Suppose further that we jump back to RetryLookup. Then fault_type will no longer contain the original fault protection mask, but instead that of the wired entry. Submitted by: Wuyang Chung Reviewed by: kib MFC after: 3 days Github PR: https://github.com/freebsd/freebsd/pull/419 Differential Revision: https://reviews.freebsd.org/D22683 --- sys/vm/vm_map.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c index 39fc18f97138..f5a82ba0b479 100644 --- a/sys/vm/vm_map.c +++ b/sys/vm/vm_map.c @@ -4687,7 +4687,7 @@ vm_map_lookup(vm_map_t *var_map, /* IN/OUT */ vm_map_entry_t entry; vm_map_t map = *var_map; vm_prot_t prot; - vm_prot_t fault_type = fault_typea; + vm_prot_t fault_type; vm_object_t eobject; vm_size_t size; struct ucred *cred; @@ -4731,7 +4731,7 @@ RetryLookupLocked: vm_map_growstack(map, vaddr, entry) == KERN_SUCCESS) goto RetryLookupLocked; } - fault_type &= VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE; + fault_type = fault_typea & VM_PROT_ALL; if ((fault_type & prot) != fault_type || prot == VM_PROT_NONE) { vm_map_unlock_read(map); return (KERN_PROTECTION_FAILURE);