fergalmoran/ladybird
1
0
Fork 0
mirror of https://github.com/fergalmoran/ladybird.git synced 2025-12-31 21:59:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Kernel: Mape quickmap functions VERIFY that MM lock is held

Browse Source 
The quickmap_page() and unquickmap_page() functions are used to map a
single physical page at a kernel virtual address for temporary access.

These use the per-CPU quickmap buffer in the page tables, and access to
this is guarded by the MM lock. To prevent bugs, quickmap_page() should
not *take* the MM lock, but rather verify that it is already held!

This exposed two situations where we were using quickmap without holding
the MM lock during page fault handling. This patch is forced to fix
these issues (which is great!) :^)
This commit is contained in:
Andreas Kling
2021-08-22 12:57:58 +02:00
parent 1b9916439f
commit a930877f31
3 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
Kernel/Memory/AnonymousVMObject.cpp
View File

@@ -346,9 +346,10 @@ PageFaultResponse AnonymousVMObject::handle_cow_fault(size_t page_index, Virtual
}
}
u8* dest_ptr = MM.quickmap_page(*page);
dbgln_if(PAGE_FAULT_DEBUG, " >> COW {} <- {}", page->paddr(), page_slot->paddr());
{
SpinlockLocker mm_locker(s_mm_lock);
u8* dest_ptr = MM.quickmap_page(*page);
SmapDisabler disabler;
void* fault_at;
if (!safe_memcpy(dest_ptr, vaddr.as_ptr(), PAGE_SIZE, fault_at)) {
@@ -361,9 +362,9 @@ PageFaultResponse AnonymousVMObject::handle_cow_fault(size_t page_index, Virtual
else
VERIFY_NOT_REACHED();
}
MM.unquickmap_page();
}
page_slot = move(page);
MM.unquickmap_page();
set_should_cow(page_index, false);
return PageFaultResponse::Continue;
}