[src/trunk]: src/sys/uvm in uvm_map_protect(), do a pmap_update() before poss...

[chs <chs%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d3a1aaaf9d87
branches:  trunk
changeset: 457054:d3a1aaaf9d87
user:      chs <chs%NetBSD.org@localhost>
date:      Sat Jun 08 23:48:33 2019 +0000

description:
in uvm_map_protect(), do a pmap_update() before possibly switching from
removing pmap entries to creating them.  this fixes the problem reported in
https://syzkaller.appspot.com/bug?id=cc89e47f05e4eea2fd69bcccb5e837f8d1ab4d60

diffstat:

 sys/uvm/uvm_map.c |  15 +++++++++++++--
 1 files changed, 13 insertions(+), 2 deletions(-)

diffs (36 lines):

diff -r 87059b27d6c9 -r d3a1aaaf9d87 sys/uvm/uvm_map.c
--- a/sys/uvm/uvm_map.c Sat Jun 08 23:23:34 2019 +0000
+++ b/sys/uvm/uvm_map.c Sat Jun 08 23:48:33 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uvm_map.c,v 1.359 2019/03/14 19:10:04 kre Exp $        */
+/*     $NetBSD: uvm_map.c,v 1.360 2019/06/08 23:48:33 chs Exp $        */
 
 /*
  * Copyright (c) 1997 Charles D. Cranor and Washington University.
@@ -66,7 +66,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.359 2019/03/14 19:10:04 kre Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.360 2019/06/08 23:48:33 chs Exp $");
 
 #include "opt_ddb.h"
 #include "opt_pax.h"
@@ -3127,6 +3127,17 @@
                    VM_MAPENT_ISWIRED(current) == 0 &&
                    old_prot == VM_PROT_NONE &&
                    new_prot != VM_PROT_NONE) {
+
+                       /*
+                        * We must call pmap_update() here because the
+                        * pmap_protect() call above might have removed some
+                        * pmap entries and uvm_map_pageable() might create
+                        * some new pmap entries that rely on the prior
+                        * removals being completely finished.
+                        */
+
+                       pmap_update(map->pmap);
+
                        if (uvm_map_pageable(map, current->start,
                            current->end, false,
                            UVM_LK_ENTER|UVM_LK_EXIT) != 0) {