From owner-svn-src-all@FreeBSD.ORG Tue Jun 18 07:04:20 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 20352FAC; Tue, 18 Jun 2013 07:04:20 +0000 (UTC) (envelope-from des@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 126501C84; Tue, 18 Jun 2013 07:04:20 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r5I74J5F034589; Tue, 18 Jun 2013 07:04:19 GMT (envelope-from des@svn.freebsd.org) Received: (from des@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r5I74J3M034587; Tue, 18 Jun 2013 07:04:19 GMT (envelope-from des@svn.freebsd.org) Message-Id: <201306180704.r5I74J3M034587@svn.freebsd.org> From: Dag-Erling Smørgrav Date: Tue, 18 Jun 2013 07:04:19 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r251902 - in stable/9: . sys/vm X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jun 2013 07:04:20 -0000 Author: des Date: Tue Jun 18 07:04:19 2013 New Revision: 251902 URL: http://svnweb.freebsd.org/changeset/base/251902 Log: Fix a bug that allowed a tracing process (e.g. gdb) to write to a memory-mapped file in the traced process's address space even if neither the traced process nor the tracing process had write access to that file. Security: CVE-2013-2171 Security: FreeBSD-SA-13:06.mmap Approved by: so Modified: stable/9/UPDATING stable/9/sys/vm/vm_map.c Modified: stable/9/UPDATING ============================================================================== --- stable/9/UPDATING Tue Jun 18 07:02:35 2013 (r251901) +++ stable/9/UPDATING Tue Jun 18 07:04:19 2013 (r251902) @@ -11,6 +11,12 @@ handbook: Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before running portupgrade. +20130618: + Fix a bug that allowed a tracing process (e.g. gdb) to write + to a memory-mapped file in the traced process's address space + even if neither the traced process nor the tracing process had + write access to that file. + 20130605: Added ZFS TRIM support which is enabled by default. To disable ZFS TRIM support set vfs.zfs.trim.enabled=0 in loader.conf. Modified: stable/9/sys/vm/vm_map.c ============================================================================== --- stable/9/sys/vm/vm_map.c Tue Jun 18 07:02:35 2013 (r251901) +++ stable/9/sys/vm/vm_map.c Tue Jun 18 07:04:19 2013 (r251902) @@ -3799,6 +3799,12 @@ RetryLookup:; vm_map_unlock_read(map); return (KERN_PROTECTION_FAILURE); } + if ((fault_typea & VM_PROT_COPY) != 0 && + (entry->max_protection & VM_PROT_WRITE) == 0 && + (entry->eflags & MAP_ENTRY_COW) == 0) { + vm_map_unlock_read(map); + return (KERN_PROTECTION_FAILURE); + } /* * If this page is not pageable, we have to get it for all possible