-
Matthew Wilcox authored
The default interruption handler "handle_interruption" does not properly check to see if the faulting space is the same as the users space. The problem lies in the fact that if a fault happens on the gateway we will not deliver signals to the process, the process will not die, and we may continue handling the same fault in a loop forever. Any malicious user code can crash the kernel by jumping into the gateway page at an inopportune address. The solution is to check if the user has the right privilege and if the spaces match, both faulting and currently active. The best action is to force the process back to it's own space of execution at address zero, and let it take a SIGSEGV. The process can never recover from this because it happens immediately after the return from the interrupt via rfi or rfir. Committed-by:
Carlos O'Donell <carlos@parisc-linux.org>
527fda69