aboutsummaryrefslogtreecommitdiffstats
path: root/arch/powerpc
diff options
context:
space:
mode:
authorSegher Boessenkool <segher@kernel.crashing.org>2007-06-19 11:07:04 -0400
committerPaul Mackerras <paulus@samba.org>2007-06-20 08:07:38 -0400
commit9ba4ace39fdfe22268daca9f28c5df384ae462cf (patch)
tree92a4ae33dec7bd3dd08f6d118ffd58a0d5247d5e /arch/powerpc
parent7c8545e98468c53809fc06788a3b9a34dff05240 (diff)
[POWERPC] PowerPC: Prevent data exception in kernel space (32-bit)
The "is_exec" branch of the protection check in do_page_fault() didn't do anything on 32-bit PowerPC. So if a userland program jumps to a page with Linux protection flags "---p", all the tests happily fall through, and handle_mm_fault() is called, which in turn calls handle_pte_fault(), which calls update_mmu_cache(), which goes flush the dcache to a page with no access rights. Boom. This fixes it. Signed-off-by: Segher Boessenkool <segher@kernel.crashing.org> Cc: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'arch/powerpc')
-rw-r--r--arch/powerpc/mm/fault.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index bfe901353142..115b25f50bf8 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -279,14 +279,13 @@ good_area:
279#endif /* CONFIG_8xx */ 279#endif /* CONFIG_8xx */
280 280
281 if (is_exec) { 281 if (is_exec) {
282#ifdef CONFIG_PPC64 282#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
283 /* protection fault */ 283 /* protection fault */
284 if (error_code & DSISR_PROTFAULT) 284 if (error_code & DSISR_PROTFAULT)
285 goto bad_area; 285 goto bad_area;
286 if (!(vma->vm_flags & VM_EXEC)) 286 if (!(vma->vm_flags & VM_EXEC))
287 goto bad_area; 287 goto bad_area;
288#endif 288#else
289#if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
290 pte_t *ptep; 289 pte_t *ptep;
291 pmd_t *pmdp; 290 pmd_t *pmdp;
292 291