[PATCH 133/222] ARM: missing ->mmap_sem around find_vma() in swp_emulate.c

[Herton Ronaldo Krzesinski]

3.5.7.3 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <v...@zeniv.linux.org.uk>

commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream.

find_vma() is *not* safe when somebody else is removing vmas.  Not just
the return value might get bogus just as you are getting it (this instance
doesn't try to dereference the resulting vma), the search itself can get
buggered in rather spectacular ways.  IOW, ->mmap_sem really, really is
not optional here.

Signed-off-by: Al Viro <v...@zeniv.linux.org.uk>
Signed-off-by: Russell King <rmk+ker...@arm.linux.org.uk>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesin...@canonical.com>
---
 arch/arm/kernel/swp_emulate.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/kernel/swp_emulate.c b/arch/arm/kernel/swp_emulate.c
index df74518..ab1017b 100644
--- a/arch/arm/kernel/swp_emulate.c
+++ b/arch/arm/kernel/swp_emulate.c
@@ -109,10 +109,12 @@ static void set_segfault(struct pt_regs *regs, unsigned 
long addr)
 {
        siginfo_t info;
 
+       down_read(&current->mm->mmap_sem);
        if (find_vma(current->mm, addr) == NULL)
                info.si_code = SEGV_MAPERR;
        else
                info.si_code = SEGV_ACCERR;
+       up_read(&current->mm->mmap_sem);
 
        info.si_signo = SIGSEGV;
        info.si_errno = 0;
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/