diff options
| author | kib <kib@FreeBSD.org> | 2013-06-03 04:32:53 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2013-06-03 04:32:53 +0000 |
| commit | fd6876af27798e416c5499b4a43727ab5b95630f (patch) | |
| tree | 931bb9478cd334e17fd34f35de34b177cdefdb0d /sys/kern | |
| parent | f82ed4d643eddd388a9dc1b638f889a83c397012 (diff) | |
| download | FreeBSD-src-fd6876af27798e416c5499b4a43727ab5b95630f.zip FreeBSD-src-fd6876af27798e416c5499b4a43727ab5b95630f.tar.gz | |
Do not map the shared page COW. If the process wired its address
space, fork(2) would cause shadowing of the physical object and
copying of the shared page into private copy, effectively preventing
updates for the exported timehands structure and stopping the clock.
Specify the maximum allowed permissions for the page to be read and
execute, preventing write from the user mode.
Reported and tested by: <huanghwh@yahoo.com>
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/kern_exec.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 3890157..c45b974 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -1050,8 +1050,9 @@ exec_new_vmspace(imgp, sv) vm_object_reference(obj); error = vm_map_fixed(map, obj, 0, sv->sv_shared_page_base, sv->sv_shared_page_len, - VM_PROT_READ | VM_PROT_EXECUTE, VM_PROT_ALL, - MAP_COPY_ON_WRITE | MAP_ACC_NO_CHARGE); + VM_PROT_READ | VM_PROT_EXECUTE, + VM_PROT_READ | VM_PROT_EXECUTE, + MAP_INHERIT_SHARE | MAP_ACC_NO_CHARGE); if (error) { vm_object_deallocate(obj); return (error); |
