svn commit: r356371 - head/sys/kern

[Kyle Evans]

Author: kevans
Date: Sun Jan  5 03:15:16 2020
New Revision: 356371
URL: https://svnweb.freebsd.org/changeset/base/356371

Log:
  shmfd/mmap: restrict maxprot with MAP_SHARED + F_SEAL_WRITE
  
  If a write seal is set on a shared mapping, we must exclude VM_PROT_WRITE as
  the fd is effectively read-only. This was discovered by running
  devel/linux-ltp, which mmap's with acceptable protections specified then
  attempts to raise to PROT_READ|PROT_WRITE with mprotect(2), which we
  allowed.
  
  Reviewed by:	kib
  Differential Revision:	https://reviews.freebsd.org/D22978

Modified:
  head/sys/kern/uipc_shm.c

Modified: head/sys/kern/uipc_shm.c
==============================================================================
--- head/sys/kern/uipc_shm.c	Sun Jan  5 03:07:59 2020	(r356370)
+++ head/sys/kern/uipc_shm.c	Sun Jan  5 03:15:16 2020	(r356371)
@@ -1116,7 +1116,13 @@ shm_mmap(struct file *fp, vm_map_t map, vm_offset_t *a
 	/* FREAD should always be set. */
 	if ((fp->f_flag & FREAD) != 0)
 		maxprot |= VM_PROT_EXECUTE | VM_PROT_READ;
-	if ((fp->f_flag & FWRITE) != 0)
+
+	/*
+	 * If FWRITE's set, we can allow VM_PROT_WRITE unless it's a shared
+	 * mapping with a write seal applied.
+	 */
+	if ((fp->f_flag & FWRITE) != 0 && ((flags & MAP_SHARED) == 0 ||
+	    (shmfd->shm_seals & F_SEAL_WRITE) == 0))
 		maxprot |= VM_PROT_WRITE;
 
 	writecnt = (flags & MAP_SHARED) != 0 && (prot & VM_PROT_WRITE) != 0;