search for: foll_flags

...ht get reCOWed by userspace write). + * pte_write. We cannot simply drop FOLL_WRITE + * here because the COWed page might be gone by + * the time we do the subsequent page lookups. */ if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE)) - foll_flags &= ~FOLL_WRITE; + foll_flags |= FOLL_COW; cond_resched(); }

On Tue, 25 Oct 2016 10:06:12 +0200 Christian Anthon <anthon at rth.dk> wrote: > What is the best approach on centos 6 to mitigate the problem is > officially patched? As far as I can tell Centos 6 is vulnerable to > attacks using ptrace. I can confirm that c6 is vulnerable, we're running a patched kernel (local build) using a rhel6 adaptation of the upstream fix. Ask

...t's documentation this seems >> impossible - it is supposed to only ever return # of pages >> pinned or errno. >> >> However, poking at code, I see at least one path that might cause this: >> >> ret = faultin_page(tsk, vma, start, &foll_flags, >> nonblocking); >> switch (ret) { >> case 0: >> goto retry; >> case -EFAULT: >> case -ENOMEM:...

...ES) += page-discard.o diff -urpN linux-2.6/mm/memory.c linux-2.6-patched/mm/memory.c --- linux-2.6/mm/memory.c 2006-09-01 12:49:33.000000000 +0200 +++ linux-2.6-patched/mm/memory.c 2006-09-01 12:49:36.000000000 +0200 @@ -1058,6 +1058,7 @@ int get_user_pages(struct task_struct *t if (write) foll_flags |= FOLL_WRITE; +retry: cond_resched(); while (!(page = follow_page(vma, start, foll_flags))) { int ret; @@ -1087,6 +1088,22 @@ int get_user_pages(struct task_struct *t BUG(); } } + if (foll_flags & FOLL_GET) { + /* + * The pages are only made stable in cas...

...ES) += page-discard.o diff -urpN linux-2.6/mm/memory.c linux-2.6-patched/mm/memory.c --- linux-2.6/mm/memory.c 2006-09-01 12:49:33.000000000 +0200 +++ linux-2.6-patched/mm/memory.c 2006-09-01 12:49:36.000000000 +0200 @@ -1058,6 +1058,7 @@ int get_user_pages(struct task_struct *t if (write) foll_flags |= FOLL_WRITE; +retry: cond_resched(); while (!(page = follow_page(vma, start, foll_flags))) { int ret; @@ -1087,6 +1088,22 @@ int get_user_pages(struct task_struct *t BUG(); } } + if (foll_flags & FOLL_GET) { + /* + * The pages are only made stable in cas...

...BUG_ON(r != 1); Just looking at get_user_pages_fast's documentation this seems impossible - it is supposed to only ever return # of pages pinned or errno. However, poking at code, I see at least one path that might cause this: ret = faultin_page(tsk, vma, start, &foll_flags, nonblocking); switch (ret) { case 0: goto retry; case -EFAULT: case -ENOMEM: case -EHWPOISON:...