diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2011-10-03 17:01:31 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2011-10-03 17:01:31 +0000 |
| commit | c06f5f6ceaee79d4b26fd851d7b1441eaafd2aab (patch) | |
| tree | 2f1498ede3d8fc07131e1ed25b92cbf310d811cb /sys | |
| parent | 24f3dcfe5094a99e5d695551e622dcb05fcdecf4 (diff) | |
| download | src-c06f5f6ceaee79d4b26fd851d7b1441eaafd2aab.tar.gz src-c06f5f6ceaee79d4b26fd851d7b1441eaafd2aab.zip | |
Do not allow the kernel to access usermode pages without installed
fault handler. Panic immediately in such situation, on i386 and amd64.
Reviewed by: avg, jhb
MFC after: 1 week
Notes
Notes:
svn path=/head/; revision=225943
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/amd64/amd64/trap.c | 13 | ||||
| -rw-r--r-- | sys/i386/i386/trap.c | 5 |
2 files changed, 18 insertions, 0 deletions
diff --git a/sys/amd64/amd64/trap.c b/sys/amd64/amd64/trap.c index 16f151fce3ef..9c72a693a0a4 100644 --- a/sys/amd64/amd64/trap.c +++ b/sys/amd64/amd64/trap.c @@ -674,6 +674,19 @@ trap_pfault(frame, usermode) goto nogo; map = &vm->vm_map; + + /* + * When accessing a usermode address, kernel must be + * ready to accept the page fault, and provide a + * handling routine. Since accessing the address + * without the handler is a bug, do not try to handle + * it normally, and panic immediately. + */ + if (!usermode && (td->td_intr_nesting_level != 0 || + PCPU_GET(curpcb)->pcb_onfault == NULL)) { + trap_fatal(frame, eva); + return (-1); + } } /* diff --git a/sys/i386/i386/trap.c b/sys/i386/i386/trap.c index fbbfbc5ed09e..5006f41be1ec 100644 --- a/sys/i386/i386/trap.c +++ b/sys/i386/i386/trap.c @@ -831,6 +831,11 @@ trap_pfault(frame, usermode, eva) goto nogo; map = &vm->vm_map; + if (!usermode && (td->td_intr_nesting_level != 0 || + PCPU_GET(curpcb)->pcb_onfault == NULL)) { + trap_fatal(frame, eva); + return (-1); + } } /* |