Michael Ellerman fe936dfc23 mm: check that we have the right vma in __access_remote_vm() ... In __access_remote_vm() we need to check that we have found the right vma, not the following vma before we try to access it. Otherwise we might call the vma's access routine with an address which does not fall inside the vma. It was discovered on a current kernel but with an unreleased driver, from memory it was strace leading to a kernel bad access, but it obviously depends on what the access implementation does. Looking at other access implementations I only see: $ git grep -A 5 vm_operations|grep access arch/powerpc/platforms/cell/spufs/file.c- .access = spufs_mem_mmap_access, arch/x86/pci/i386.c- .access = generic_access_phys, drivers/char/mem.c- .access = generic_access_phys fs/sysfs/bin.c- .access = bin_access, The spufs one looks like it might behave badly given the wrong vma, it assumes vma->vm_file->private_data is a spu_context, and looks like it would probably blow up pretty quickly if it wasn't. generic_access_phys() only uses the vma to check vm_flags and get the mm, and then walks page tables using the address. So it should bail on the vm_flags check, or at worst let you access some other VM_IO mapping. And bin_access() just proxies to another access implementation. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: Hugh Dickins <hughd@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2011-04-14 16:06:55 -07:00
..
backing-dev.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
bootmem.c	crash_dump: export is_kdump_kernel to modules, consolidate elfcorehdr_addr, setup_elfcorehdr and saved_max_pfn	2011-03-23 19:47:19 -07:00
bounce.c	bounce: call flush_dcache_page() after bounce_copy_vec()	2010-09-09 18:57:25 -07:00
compaction.c	mm: compaction: minimise the time IRQs are disabled while isolating pages for migration	2011-03-22 17:44:05 -07:00
debug-pagealloc.c	generic debug pagealloc	2009-04-01 08:59:13 -07:00
dmapool.c	mm/dmapool.c: use TASK_UNINTERRUPTIBLE in dma_pool_alloc()	2011-01-13 17:32:48 -08:00
fadvise.c	readahead: introduce FMODE_RANDOM for POSIX_FADV_RANDOM	2010-03-06 11:26:25 -08:00
failslab.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
filemap_xip.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
filemap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	2011-03-24 19:01:30 -07:00
fremap.c	Avoid pgoff overflow in remap_file_pages	2010-09-25 09:34:58 -07:00
highmem.c	mm,x86: fix kmap_atomic_push vs ioremap_32.c	2010-10-27 18:03:05 -07:00
huge_memory.c	mm: add VM counters for transparent hugepages	2011-04-14 16:06:55 -07:00
hugetlb.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
hwpoison-inject.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
init-mm.c	mm: provide init_mm mm_context initializer	2010-08-09 20:44:54 -07:00
internal.h	Fix common misspellings	2011-03-31 11:26:23 -03:00
Kconfig	mm: compaction: don't depend on HUGETLB_PAGE	2011-01-26 10:50:02 +10:00
Kconfig.debug	mm: debug-pagealloc: fix kconfig dependency warning	2011-03-22 17:44:02 -07:00
kmemcheck.c	kmemcheck: Fix build errors due to missing slab.h	2010-03-30 22:02:32 +09:00
kmemleak-test.c	kmemleak: remove memset by using kzalloc	2011-01-27 18:31:51 +00:00
kmemleak.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
ksm.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
maccess.c	MN10300: Save frame pointer in thread_info struct rather than global var	2010-10-27 17:29:01 +01:00
madvise.c	thp: khugepaged: make khugepaged aware about madvise	2011-01-13 17:32:47 -08:00
Makefile	bootmem: Separate out CONFIG_NO_BOOTMEM code into nobootmem.c	2011-02-24 14:43:05 +01:00
memblock.c	mm/memblock: properly handle overlaps and fix error path	2011-03-22 17:44:09 -07:00
memcontrol.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
memory_hotplug.c	mm: optimize pfn calculation in online_page()	2011-04-14 16:06:54 -07:00
memory-failure.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
memory.c	mm: check that we have the right vma in __access_remote_vm()	2011-04-14 16:06:55 -07:00
mempolicy.c	mempolicy: remove redundant check in __mpol_equal()	2011-03-22 17:44:04 -07:00
mempool.c	mm: remove broken 'kzalloc' mempool	2009-09-22 07:17:35 -07:00
migrate.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
mincore.c	thp: mincore transparent hugepage support	2011-01-13 17:32:44 -08:00
mlock.c	vm: fix mlock() on stack guard page	2011-04-12 14:15:51 -07:00
mm_init.c
mmap.c	brk: COMPAT_BRK: fix detection of randomized brk	2011-04-14 16:06:55 -07:00
mmu_context.c	exit: fix oops in sync_mm_rss	2010-03-24 16:31:21 -07:00
mmu_notifier.c	thp: mmu_notifier_test_young	2011-01-13 17:32:46 -08:00
mmzone.c	mm: page allocator: adjust the per-cpu counter threshold when memory is low	2011-01-13 17:32:31 -08:00
mprotect.c	thp: mprotect: transparent huge page support	2011-01-13 17:32:44 -08:00
mremap.c	mm: avoid wrapping vm_pgoff in mremap()	2011-04-07 07:35:51 -07:00
msync.c	sanitize vfs_fsync calling conventions	2010-05-21 18:31:21 -04:00
nobootmem.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
nommu.c	NOMMU: implement access_remote_vm	2011-03-29 14:05:12 +01:00
oom_kill.c	lib, arch: add filter argument to show_mem and fix private implementations	2011-03-24 17:49:37 -07:00
page_alloc.c	mm/page_alloc.c: silence build_all_zonelists() section mismatch	2011-04-14 16:06:54 -07:00
page_cgroup.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
page_io.c	block: kill off REQ_UNPLUG	2011-03-10 08:52:27 +01:00
page_isolation.c	mm: page_isolation: codeclean fix comment and rm unneeded val init	2010-10-26 16:52:11 -07:00
page-writeback.c	Merge branch 'for-2.6.39/core' of git://git.kernel.dk/linux-2.6-block	2011-03-24 10:16:26 -07:00
pagewalk.c	pagewalk: only split huge pages when necessary	2011-03-22 17:44:04 -07:00
percpu-km.c	percpu: clear memory allocated with the km allocator	2010-10-02 10:28:42 +03:00
percpu-vm.c	mm: remove gfp mask from pcpu_get_vm_areas	2011-01-13 17:32:34 -08:00
percpu.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
pgtable-generic.c	mm/pgtable-generic.c: fix CONFIG_SWAP=n build	2011-01-26 10:49:58 +10:00
prio_tree.c
quicklist.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
readahead.c	read-ahead: use plugging	2011-03-10 08:52:26 +01:00
rmap.c	fs: move i_wb_list out from under inode_lock	2011-03-24 21:17:51 -04:00
shmem.c	tmpfs: fix off-by-one in max_blocks checks	2011-04-14 16:06:55 -07:00
slab.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
slob.c	mm: Remove support for kmem_cache_name()	2011-01-23 21:00:05 +02:00
slub.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
sparse-vmemmap.c	tree-wide: fix comment/printk typos	2010-11-01 15:38:34 -04:00
sparse.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
swap_state.c	block: remove per-queue plugging	2011-03-10 08:52:07 +01:00
swap.c	mm: simplify code of swap.c	2011-03-22 17:44:09 -07:00
swapfile.c	Merge branch 'for-2.6.39/core' of git://git.kernel.dk/linux-2.6-block	2011-03-24 10:16:26 -07:00
thrash.c	mm: pass mm to grab_swap_token	2009-06-23 12:50:05 -07:00
truncate.c	mm: deactivate invalidated pages	2011-03-22 17:44:03 -07:00
util.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
vmalloc.c	vmalloc: remove confusing comment on vwrite()	2011-03-22 17:44:09 -07:00
vmscan.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
vmstat.c	mm: add VM counters for transparent hugepages	2011-04-14 16:06:55 -07:00