summaryrefslogtreecommitdiff
blob: ef2d0a78206b453391d855ee0da24e18e007bc8c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
http://www.freebsd.org/security/advisories/FreeBSD-SA-13:06.mmap.asc
https://bugs.gentoo.org/show_bug.cgi?id=473688

Index: sys/vm/vm_map.c
===================================================================
--- sys/vm/vm_map.c	(revision 251636)
+++ sys/vm/vm_map.c	(working copy)
@@ -3761,6 +3761,12 @@ RetryLookup:;
 		vm_map_unlock_read(map);
 		return (KERN_PROTECTION_FAILURE);
 	}
+	if ((fault_typea & VM_PROT_COPY) != 0 &&
+	    (entry->max_protection & VM_PROT_WRITE) == 0 &&
+	    (entry->eflags & MAP_ENTRY_COW) == 0) {
+		vm_map_unlock_read(map);
+		return (KERN_PROTECTION_FAILURE);
+	}
 
 	/*
 	 * If this page is not pageable, we have to get it for all possible