um: Ensure that a stub page cannot get unmapped
authorRichard Weinberger <richard@nod.at>
Sun, 20 Jul 2014 11:09:15 +0000 (13:09 +0200)
committerRichard Weinberger <richard@nod.at>
Sun, 20 Jul 2014 11:09:15 +0000 (13:09 +0200)
Trinity discovered an execution path such that a task
can unmap his stub page.

Reported-by: Toralf Förster <toralf.foerster@gmx.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
arch/um/kernel/tlb.c

index 9472079471bbfbbac8e24632ae5b79444f47e646..1fc619e5dfe9edbaff8130881c284caa0d4846c2 100644 (file)
@@ -124,6 +124,9 @@ static int add_munmap(unsigned long addr, unsigned long len,
        struct host_vm_op *last;
        int ret = 0;
 
+       if ((addr >= STUB_START) && (addr < STUB_END))
+               return -EINVAL;
+
        if (hvc->index != 0) {
                last = &hvc->ops[hvc->index - 1];
                if ((last->type == MUNMAP) &&