Messages in this thread Patch in this message | | | Date | Fri, 23 Nov 2012 18:05:53 +0100 | From | Oleg Nesterov <> | Subject | Re: arch_check_bp_in_kernelspace: fix the range check |
| |
forgot to mention...
On 11/23, Oleg Nesterov wrote: > > On 11/23, Amnon Shiloh wrote: > > > > Or, there is an alternative: if only I (the ptracer or the traced process) > > was allowed to munmap the vsyscall page, > > It is not possible to unmap it. The kernel (swapper_pg_dir) has this > mapping, not the process. Unlike vdso. IOW, you can only "unmap" it > globally and obviously you can't do this from the userspace.
And even if this were possible, this can't help. Please look at __bad_area_nosemaphore()->emulate_vsyscall(), the process won't get SIGSEGV. IOW, in fact EMULATE already "unmaps" this page (sets _NX) to trigger the fault.
Sure, we can do something like below, but it doesn't look very nice too.
Oleg.
--- x/arch/x86/mm/fault.c +++ x/arch/x86/mm/fault.c @@ -744,7 +744,8 @@ __bad_area_nosemaphore(struct pt_regs *r */ if (unlikely((error_code & PF_INSTR) && ((address & ~0xfff) == VSYSCALL_START))) { - if (emulate_vsyscall(regs, address)) + if (!(tsk->ptrace & PTRACE_O_DONTEMULATE) && + emulate_vsyscall(regs, address)) return; } #endif
| |