diff options
| author | Segher Boessenkool <segher@kernel.crashing.org> | 2007-06-20 01:07:04 +1000 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2007-06-20 22:07:38 +1000 |
| commit | 9ba4ace39fdfe22268daca9f28c5df384ae462cf (patch) | |
| tree | 92a4ae33dec7bd3dd08f6d118ffd58a0d5247d5e /arch | |
| parent | 7c8545e98468c53809fc06788a3b9a34dff05240 (diff) | |
[POWERPC] PowerPC: Prevent data exception in kernel space (32-bit)
The "is_exec" branch of the protection check in do_page_fault()
didn't do anything on 32-bit PowerPC. So if a userland program
jumps to a page with Linux protection flags "---p", all the tests
happily fall through, and handle_mm_fault() is called, which in
turn calls handle_pte_fault(), which calls update_mmu_cache(),
which goes flush the dcache to a page with no access rights.
Boom.
This fixes it.
Signed-off-by: Segher Boessenkool <segher@kernel.crashing.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/powerpc/mm/fault.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c index bfe90135314..115b25f50bf 100644 --- a/arch/powerpc/mm/fault.c +++ b/arch/powerpc/mm/fault.c @@ -279,14 +279,13 @@ good_area: #endif /* CONFIG_8xx */ if (is_exec) { -#ifdef CONFIG_PPC64 +#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE)) /* protection fault */ if (error_code & DSISR_PROTFAULT) goto bad_area; if (!(vma->vm_flags & VM_EXEC)) goto bad_area; -#endif -#if defined(CONFIG_4xx) || defined(CONFIG_BOOKE) +#else pte_t *ptep; pmd_t *pmdp; |