Linus Torvalds 1b17844b29 mm: make fixup_user_fault() check the vma access rights too ... fixup_user_fault() is used by the futex code when the direct user access fails, and the futex code wants it to either map in the page in a usable form or return an error. It relied on handle_mm_fault() to map the page, and correctly checked the error return from that, but while that does map the page, it doesn't actually guarantee that the page will be mapped with sufficient permissions to be then accessed. So do the appropriate tests of the vma access rights by hand. [ Side note: arguably handle_mm_fault() could just do that itself, but we have traditionally done it in the caller, because some callers - notably get_user_pages() - have been able to access pages even when they are mapped with PROT_NONE. Maybe we should re-visit that design decision, but in the meantime this is the minimal patch. ] Found by Dave Jones running his trinity tool. Reported-by: Dave Jones <davej@redhat.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-04-22 13:49:40 -07:00
..
Kconfig	mm: create generic early_ioremap() support	2014-04-07 16:36:15 -07:00
Kconfig.debug	…
Makefile	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-04-12 14:49:50 -07:00
backing-dev.c	bdi: avoid oops on device removal	2014-04-03 16:20:49 -07:00
balloon_compaction.c	mm: print more details for bad_page()	2014-01-23 16:36:50 -08:00
bootmem.c	…
bounce.c	…
cleancache.c	mm: dump page when hitting a VM_BUG_ON using VM_BUG_ON_PAGE	2014-01-23 16:36:50 -08:00
compaction.c	mm, compaction: determine isolation mode only once	2014-04-07 16:35:55 -07:00
debug-pagealloc.c	…
dmapool.c	…
early_ioremap.c	mm: create generic early_ioremap() support	2014-04-07 16:36:15 -07:00
fadvise.c	…
failslab.c	…
filemap.c	mm: fix new kernel-doc warning in filemap.c	2014-04-18 16:40:09 -07:00
filemap_xip.c	…
fremap.c	mm: fix bad rss-counter if remap_file_pages raced migration	2014-03-19 16:21:49 -07:00
frontswap.c	…
highmem.c	…
huge_memory.c	thp: close race between split and zap huge pages	2014-04-18 16:40:09 -07:00
hugetlb.c	mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()	2014-04-18 16:40:08 -07:00
hugetlb_cgroup.c	cgroup: drop const from @buffer of cftype->write_string()	2014-03-19 10:23:54 -04:00
hwpoison-inject.c	mm/hwpoison: add '#' to hwpoison_inject	2014-01-21 16:19:48 -08:00
init-mm.c	…
internal.h	mm/readahead.c: inline ra_submit	2014-04-07 16:35:58 -07:00
interval_tree.c	…
iov_iter.c	take iov_iter stuff to mm/iov_iter.c	2014-04-01 23:19:30 -04:00
kmemcheck.c	…
kmemleak-test.c	…
kmemleak.c	kmemleak: change some global variables to int	2014-04-03 16:20:50 -07:00
ksm.c	mm: close PageTail race	2014-03-04 07:55:47 -08:00
list_lru.c	mm: keep page cache radix tree nodes in check	2014-04-03 16:21:01 -07:00
maccess.c	…
madvise.c	…
memblock.c	mm/memblock.c: use PFN_PHYS()	2014-04-07 16:35:58 -07:00
memcontrol.c	memcg, slab: do not destroy children caches if parent has aliases	2014-04-07 16:36:13 -07:00
memory-failure.c	Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-04-03 13:05:42 -07:00
memory.c	mm: make fixup_user_fault() check the vma access rights too	2014-04-22 13:49:40 -07:00
memory_hotplug.c	mm/memory_hotplug.c: move register_memory_resource out of the lock_memory_hotplug	2014-01-23 16:36:52 -08:00
mempolicy.c	mm, mempolicy: remove per-process flag	2014-04-07 16:35:54 -07:00
mempool.c	mempool: add unlikely and likely hints	2014-04-07 16:35:55 -07:00
migrate.c	mm: fix swapops.h:131 bug if remap_file_pages raced migration	2014-03-20 22:09:09 -07:00
mincore.c	mm + fs: prepare for non-page entries in page cache radix trees	2014-04-03 16:21:00 -07:00
mlock.c	mm: try_to_unmap_cluster() should lock_page() before mlocking	2014-04-07 16:35:57 -07:00
mm_init.c	mm: bring back /sys/kernel/mm	2014-01-27 21:02:39 -08:00
mmap.c	mm: per-thread vma caching	2014-04-07 16:35:53 -07:00
mmu_context.c	sched/mm: call finish_arch_post_lock_switch in idle_task_exit and use_mm	2014-02-21 08:50:17 +01:00
mmu_notifier.c	mm: audit/fix non-modular users of module_init in core code	2014-01-23 16:36:52 -08:00
mmzone.c	…
mprotect.c	mm: move mmu notifier call from change_protection to change_pmd_range	2014-04-07 16:35:50 -07:00
mremap.c	…
msync.c	…
nobootmem.c	mm/nobootmem.c: mark function as static	2014-04-03 16:21:02 -07:00
nommu.c	mm: fix 'ERROR: do not initialise globals to 0 or NULL' and coding style	2014-04-07 16:35:55 -07:00
oom_kill.c	mm, oom: base root bonus on current usage	2014-01-30 16:56:56 -08:00
page-writeback.c	mm: remove unused arg of set_page_dirty_balance()	2014-04-07 16:35:57 -07:00
page_alloc.c	mm/page_alloc.c: change mm debug routines back to EXPORT_SYMBOL	2014-04-07 16:35:59 -07:00
page_cgroup.c	mm/page_cgroup.c: mark functions as static	2014-04-03 16:21:02 -07:00
page_io.c	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
page_isolation.c	…
pagewalk.c	…
percpu-km.c	…
percpu-vm.c	…
percpu.c	percpu: renew the max_contig if we merge the head and previous block	2014-03-29 09:29:42 -04:00
pgtable-generic.c	…
process_vm_access.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-04-12 14:49:50 -07:00
quicklist.c	…
readahead.c	mm/readahead.c: inline ra_submit	2014-04-07 16:35:58 -07:00
rmap.c	mm: try_to_unmap_cluster() should lock_page() before mlocking	2014-04-07 16:35:57 -07:00
shmem.c	mm: Initialize error in shmem_file_aio_read()	2014-04-13 14:10:26 -07:00
slab.c	Merge branch 'slab/next' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2014-04-13 13:28:13 -07:00
slab.h	memcg, slab: never try to merge memcg caches	2014-04-07 16:36:12 -07:00
slab_common.c	memcg, slab: do not destroy children caches if parent has aliases	2014-04-07 16:36:13 -07:00
slob.c	mm: slab/slub: use page->list consistently instead of page->lru	2014-04-11 10:06:06 +03:00
slub.c	Merge branch 'slab/next' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2014-04-13 13:28:13 -07:00
sparse-vmemmap.c	mm/sparse: use memblock apis for early memory allocations	2014-01-21 16:19:47 -08:00
sparse.c	mm: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:35:54 -07:00
swap.c	mm: thrash detection-based file cache sizing	2014-04-03 16:21:01 -07:00
swap_state.c	swap: add a simple detector for inappropriate swapin readahead	2014-02-06 13:48:51 -08:00
swapfile.c	mm/swap: fix race on swap_info reuse between swapoff and swapon	2014-02-06 13:48:51 -08:00
truncate.c	mm: keep page cache radix tree nodes in check	2014-04-03 16:21:01 -07:00
util.c	Merge git://git.infradead.org/users/eparis/audit	2014-04-12 12:38:53 -07:00
vmacache.c	mm: per-thread vma caching	2014-04-07 16:35:53 -07:00
vmalloc.c	mm/vmalloc.c: enhance vm_map_ram() comment	2014-04-07 16:35:55 -07:00
vmpressure.c	arm, pm, vmpressure: add missing slab.h includes	2014-02-03 13:24:01 -05:00
vmscan.c	vmscan: reclaim_clean_pages_from_list() must use mod_zone_page_state()	2014-04-18 16:40:07 -07:00
vmstat.c	CPU hotplug notifiers registration fixes for 3.15-rc1	2014-04-07 14:55:46 -07:00
workingset.c	mm: keep page cache radix tree nodes in check	2014-04-03 16:21:01 -07:00
zbud.c	…
zsmalloc.c	zsmalloc: Fix CPU hotplug callback registration	2014-03-20 13:43:45 +01:00
zswap.c	Merge branch 'akpm' (incoming from Andrew)	2014-04-07 16:38:06 -07:00