Author: andrew
Date: Wed May 30 15:25:48 2018
New Revision: 334385
URL: https://svnweb.freebsd.org/changeset/base/334385
Log:
Further limit when we call pmap_fault.
We should only call pmap_fault in the kernel when accessing a userspace
address. As this should always happen through specific functions that set
a fault handler we can use this to limit calls to pmap_fault to when this
is set.
This should help with NULL pointer dereferences when we are unable to sleep
so we fall into the correct case.
Sponsored by: DARPA, AFRL
Modified:
head/sys/arm64/arm64/trap.c
Modified: head/sys/arm64/arm64/trap.c
==============================================================================
--- head/sys/arm64/arm64/trap.c Wed May 30 15:08:59 2018 (r334384)
+++ head/sys/arm64/arm64/trap.c Wed May 30 15:25:48 2018 (r334385)
@@ -190,16 +190,32 @@ data_abort(struct thread *td, struct trapframe *frame,
}
/*
- * We may fault from userspace or when in a DMAP region due to
- * a superpage being unmapped when the access took place. In these
- * cases we need to wait for the pmap to be unlocked and check
- * if the translation is still invalid.
+ * The call to pmap_fault can be dangerous when coming from the
+ * kernel as it may be not be able to lock the pmap to check if
+ * the address is now valid. Because of this we filter the cases
+ * when we are not going to see superpage activity.
*/
- if (map != kernel_map || VIRT_IN_DMAP(far)) {
- if (pmap_fault(map->pmap, esr, far) == KERN_SUCCESS)
- return;
+ if (!lower) {
+ /*
+ * We may fault in a DMAP region due to a superpage being
+ * unmapped when the access took place.
+ */
+ if (map == kernel_map && !VIRT_IN_DMAP(far))
+ goto no_pmap_fault;
+ /*
+ * We can also fault in the userspace handling functions,
+ * e.g. copyin. In these cases we will have set a fault
+ * handler so we can check if this is set before calling
+ * pmap_fault.
+ */
+ if (map != kernel_map && pcb->pcb_onfault == 0)
+ goto no_pmap_fault;
}
+ if (pmap_fault(map->pmap, esr, far) == KERN_SUCCESS)
+ return;
+
+no_pmap_fault:
KASSERT(td->td_md.md_spinlock_count == 0,
("data abort with spinlock held"));
if (td->td_critnest != 0 || WITNESS_CHECK(WARN_SLEEPOK |
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
