Page MenuHomeFreeBSD

Relax restrictions on private mappings of POSIX shm objects.
ClosedPublic

Authored by markj on Apr 13 2020, 4:50 PM.

Details

Summary

When we create a private mapping of an shm object, VM_PROT_WRITE should
always be included in maxprot regardless of permissions on the
underlying FD. Otherwise it is possible to open a shm object read-only,
map it with MAP_PRIVATE and PROT_WRITE, and violate the invariant in
vm_map_insert() that (prot & maxprot) == prot.

Test Plan

syzkaller generated a program that triggers the aforementioned
assertion failure:
http://syzkaller.backtrace.io:8080/report?id=ba93405590ed607e9b2d65025a44ff60dc6c4bcc

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable