• Linus Torvalds's avatar
    Fix incorrect user space access locking in mincore() (CVE-2006-4814) · 7c876d45
    Linus Torvalds authored
    Doug Chapman noticed that mincore() will doa "copy_to_user()" of the
    result while holding the mmap semaphore for reading, which is a big
    no-no.  While a recursive read-lock on a semaphore in the case of a page
    fault happens to work, we don't actually allow them due to deadlock
    schenarios with writers due to fairness issues.
    
    Doug and Marcel sent in a patch to fix it, but I decided to just rewrite
    the mess instead - not just fixing the locking problem, but making the
    code smaller and (imho) much easier to understand.
    
    Also included are two fixes for the original patch including one
    by Oleg Nesterov.
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
    7c876d45
mincore.c 4.18 KB