diff options
author | Russell King <rmk+kernel@arm.linux.org.uk> | 2009-09-28 06:41:51 -0400 |
---|---|---|
committer | Russell King <rmk+kernel@arm.linux.org.uk> | 2009-09-28 13:06:21 -0400 |
commit | aa45ee8fc0ee87c1711b5fe8eb3556d06530c39e (patch) | |
tree | 4fd5a65dd1dda67ba8e2c4857bf1c7f5c19edaf8 /arch | |
parent | 90140c30a7b8c77e8872a389d48678d78e58789f (diff) |
ARM: Ensure do_cache_op takes mmap_sem
do_cache_op() uses find_vma() to validate its arguments without holding
any locking. This means that the VMA could vanish beneath us. Fix
this by taking a read lock on mmap_sem.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Diffstat (limited to 'arch')
-rw-r--r-- | arch/arm/kernel/traps.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c index 57eb0f6f6005..467b69ed1021 100644 --- a/arch/arm/kernel/traps.c +++ b/arch/arm/kernel/traps.c | |||
@@ -418,12 +418,14 @@ static int bad_syscall(int n, struct pt_regs *regs) | |||
418 | static inline void | 418 | static inline void |
419 | do_cache_op(unsigned long start, unsigned long end, int flags) | 419 | do_cache_op(unsigned long start, unsigned long end, int flags) |
420 | { | 420 | { |
421 | struct mm_struct *mm = current->active_mm; | ||
421 | struct vm_area_struct *vma; | 422 | struct vm_area_struct *vma; |
422 | 423 | ||
423 | if (end < start || flags) | 424 | if (end < start || flags) |
424 | return; | 425 | return; |
425 | 426 | ||
426 | vma = find_vma(current->active_mm, start); | 427 | down_read(&mm->mmap_sem); |
428 | vma = find_vma(mm, start); | ||
427 | if (vma && vma->vm_start < end) { | 429 | if (vma && vma->vm_start < end) { |
428 | if (start < vma->vm_start) | 430 | if (start < vma->vm_start) |
429 | start = vma->vm_start; | 431 | start = vma->vm_start; |
@@ -432,6 +434,7 @@ do_cache_op(unsigned long start, unsigned long end, int flags) | |||
432 | 434 | ||
433 | flush_cache_user_range(vma, start, end); | 435 | flush_cache_user_range(vma, start, end); |
434 | } | 436 | } |
437 | up_read(&mm->mmap_sem); | ||
435 | } | 438 | } |
436 | 439 | ||
437 | /* | 440 | /* |