Differential D24398

Relax restrictions on private mappings of POSIX shm objects.
ClosedPublic
Actions

Authored by markj on Apr 13 2020, 4:50 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Tue, Mar 17, 3:38 AM

	Unknown Object (File)
	Tue, Mar 17, 3:38 AM

	Unknown Object (File)
	Mon, Mar 2, 7:05 AM

	Unknown Object (File)
	Sat, Feb 28, 8:07 AM

	Unknown Object (File)
	Fri, Feb 27, 7:18 AM

	Unknown Object (File)
	Feb 8 2026, 8:35 AM

	Unknown Object (File)
	Feb 8 2026, 6:13 AM

	Unknown Object (File)
	Jan 30 2026, 4:23 PM

View All 98 Files

Subscribers

Details

Reviewers

kib
kevans

Commits

rS359892: Relax restrictions on private mappings of POSIX shm objects.

Summary

When we create a private mapping of an shm object, VM_PROT_WRITE should
always be included in maxprot regardless of permissions on the
underlying FD. Otherwise it is possible to open a shm object read-only,
map it with MAP_PRIVATE and PROT_WRITE, and violate the invariant in
vm_map_insert() that (prot & maxprot) == prot.

Test Plan

syzkaller generated a program that triggers the aforementioned
assertion failure:
http://syzkaller.backtrace.io:8080/report?id=ba93405590ed607e9b2d65025a44ff60dc6c4bcc

Diff Detail

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 30464
Build 28221: arc lint + arc unit

Event Timeline

markj created this revision.Apr 13 2020, 4:50 PM

Harbormaster completed remote builds in B30464: Diff 70503.Apr 13 2020, 4:50 PM

markj edited the test plan for this revision. (Show Details)Apr 13 2020, 4:50 PM

markj added reviewers: kib, kevans.

kevans accepted this revision.Apr 13 2020, 5:02 PM

This revision is now accepted and ready to land.Apr 13 2020, 5:02 PM

kib accepted this revision.Apr 13 2020, 5:42 PM

Closed by commit rS359892: Relax restrictions on private mappings of POSIX shm objects. (authored by markj). · Explain WhyApr 13 2020, 7:20 PM

This revision was automatically updated to reflect the committed changes.

markj added a commit: rS359892: Relax restrictions on private mappings of POSIX shm objects..

Herald added a subscriber: imp. · View Herald TranscriptApr 13 2020, 7:20 PM

Revision Contents
Changeset List

Path

Size

sys/

kern/

33 lines

Diff 70503

sys/kern/uipc_shm.c

Loading...