From owner-cvs-all  Tue Jan  1  9: 1: 0 2002
Delivered-To: cvs-all@freebsd.org
Received: from mailman.zeta.org.au (mailman.zeta.org.au [203.26.10.16])
	by hub.freebsd.org (Postfix) with ESMTP
	id 94F4B37B41F; Tue,  1 Jan 2002 09:00:53 -0800 (PST)
Received: from bde.zeta.org.au (bde.zeta.org.au [203.2.228.102])
	by mailman.zeta.org.au (8.9.3/8.8.7) with ESMTP id EAA11360;
	Wed, 2 Jan 2002 04:00:50 +1100
Date: Wed, 2 Jan 2002 04:00:45 +1100 (EST)
From: Bruce Evans <bde@zeta.org.au>
X-X-Sender:  <bde@gamplex.bde.org>
To: John Baldwin <jhb@FreeBSD.org>
Cc: Poul-Henning Kamp <phk@FreeBSD.org>, <cvs-all@FreeBSD.org>,
	<cvs-committers@FreeBSD.org>
Subject: RE: cvs commit: src/sys/i386/i386 trap.c
In-Reply-To: <XFMail.011231123911.jhb@FreeBSD.org>
Message-ID: <20020102035156.M10589-100000@gamplex.bde.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
List-ID: <cvs-all.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20cvs-all>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20cvs-all>
X-Loop: FreeBSD.ORG

On Mon, 31 Dec 2001, John Baldwin wrote:

> On 30-Dec-01 Poul-Henning Kamp wrote:
> > phk         2001/12/30 11:43:59 PST
> >
> >   Modified files:
> >     sys/i386/i386        trap.c
> >   Log:
> >   GC an alternate trap_pfault() which has rotted away behind an "#ifdef
> > notyet"
> >   since 21-Mar-95 .
>
> I thought we wanted to switch to using it as it simplifies some of the kernel
> fault handling but just had a few unsafe places in the kernel to fix?

I added the check for disallowing pagefaults for user addresses in kernel
mode except ones for copying functions.   It is just the

    (!usermode && PCPU_GET(curpcb)->pcb_onfault == NULL)

part of the patch (the other changes are mostly to optimize some copying
functions).  I haven't merged any of the simplifications from the old
version.

%%%
Index: trap.c
===================================================================
RCS file: /home/ncvs/src/sys/i386/i386/trap.c,v
retrieving revision 1.210
diff -u -2 -r1.210 trap.c
--- trap.c	30 Dec 2001 19:43:59 -0000	1.210
+++ trap.c	1 Jan 2002 16:39:50 -0000
@@ -688,10 +719,21 @@
 		/*
 		 * This is a fault on non-kernel virtual memory.
-		 * vm is initialized above to NULL. If curproc is NULL
-		 * or curproc->p_vmspace is NULL the fault is fatal.
+		 * Do not allow it in kernel mode unless it is for a
+		 * a recognized copying function.
 		 */
-		if (p != NULL)
-			vm = p->p_vmspace;
+		if (!usermode &&
+		    frame->tf_eip != (int)fubyte_access &&
+		    frame->tf_eip != (int)fusword_access &&
+		    frame->tf_eip != (int)fuword_access &&
+		    frame->tf_eip != (int)subyte_access &&
+		    frame->tf_eip != (int)susword_access &&
+		    frame->tf_eip != (int)suword_access &&
+		    PCPU_GET(curpcb)->pcb_onfault == NULL)
+			goto nogo;

+		/*
+		 * If curproc->p_vmspace is NULL the fault is fatal.
+		 */
+		vm = p->p_vmspace;
 		if (vm == NULL)
 			goto nogo;

%%%

This is completely untested (except for removing the p != NULL check).

Bruce


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message