Attachment #167570 for bug #204426




	int result;

	td = curthread;
if ((td->td_pflags & TDP_NOFAULTING) != 0) printf("pid %d kpf 1\n", curproc->p_pid);
	if ((td->td_pflags & TDP_NOFAULTING) != 0)
		return (KERN_PROTECTION_FAILURE);
#ifdef KTRACE

		 */
		if (fs.object->flags & OBJ_DEAD) {
			unlock_and_deallocate(&fs);
printf("pid %d kpf 2\n", curproc->p_pid);
			return (KERN_PROTECTION_FAILURE);
		}


		    fs.object == fs.first_object) {
			if (fs.pindex >= fs.object->size) {
				unlock_and_deallocate(&fs);
printf("pid %d kpf 3 %jd %jd\n", curproc->p_pid, (uintmax_t)fs.pindex, (uintmax_t)fs.object->size);
				return (KERN_PROTECTION_FAILURE);
			}


				vm_page_unlock(fs.m);
				fs.m = NULL;
				unlock_and_deallocate(&fs);
if (rv != VM_PAGER_ERROR) printf("pid %d kpf 4\n", curproc->p_pid);
				return ((rv == VM_PAGER_ERROR) ? KERN_FAILURE : KERN_PROTECTION_FAILURE);
			}
			if (fs.object != fs.first_object) {




	prot = entry->protection;
	fault_type &= (VM_PROT_READ|VM_PROT_WRITE|VM_PROT_EXECUTE);
	if ((fault_type & prot) != fault_type || prot == VM_PROT_NONE) {
printf("pid %d kpf 5 %x %x\n", curproc->p_pid, fault_type, prot);
		vm_map_unlock_read(map);
		return (KERN_PROTECTION_FAILURE);
	}

	    (entry->max_protection & VM_PROT_WRITE) == 0 &&
	    (entry->eflags & MAP_ENTRY_COW) == 0) {
		vm_map_unlock_read(map);
printf("pid %d kpf 6\n", curproc->p_pid);
		return (KERN_PROTECTION_FAILURE);
	}


	 */
	prot = entry->protection;
	fault_type &= VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE;
if ((fault_type & prot) != fault_type) printf("pid %d kpf 7 %x %x\n", curproc->p_pid, fault_type, prot);
	if ((fault_type & prot) != fault_type)
		return (KERN_PROTECTION_FAILURE);


Return to bug 204426

Lines 263-268 vm_fault(vm_map_t map, vm_offset_t vaddr, vm_prot_t fault_type, Link Here

(-)b/sys/vm/vm_fault.c (+4 lines)
263	int result;	263	int result;
264		264
265	td = curthread;	265	td = curthread;
		266	if ((td->td_pflags & TDP_NOFAULTING) != 0) printf("pid %d kpf 1\n", curproc->p_pid);
266	if ((td->td_pflags & TDP_NOFAULTING) != 0)	267	if ((td->td_pflags & TDP_NOFAULTING) != 0)
267	return (KERN_PROTECTION_FAILURE);	268	return (KERN_PROTECTION_FAILURE);
268	#ifdef KTRACE	269	#ifdef KTRACE
Lines 425-430 fast_failed: Link Here
425	*/	426	*/
426	if (fs.object->flags & OBJ_DEAD) {	427	if (fs.object->flags & OBJ_DEAD) {
427	unlock_and_deallocate(&fs);	428	unlock_and_deallocate(&fs);
		429	printf("pid %d kpf 2\n", curproc->p_pid);
428	return (KERN_PROTECTION_FAILURE);	430	return (KERN_PROTECTION_FAILURE);
429	}	431	}
430		432
Lines 506-511 fast_failed: Link Here
506	fs.object == fs.first_object) {	508	fs.object == fs.first_object) {
507	if (fs.pindex >= fs.object->size) {	509	if (fs.pindex >= fs.object->size) {
508	unlock_and_deallocate(&fs);	510	unlock_and_deallocate(&fs);
		511	printf("pid %d kpf 3 %jd %jd\n", curproc->p_pid, (uintmax_t)fs.pindex, (uintmax_t)fs.object->size);
509	return (KERN_PROTECTION_FAILURE);	512	return (KERN_PROTECTION_FAILURE);
510	}	513	}
511		514
Lines 698-703 vnode_locked: Link Here
698	vm_page_unlock(fs.m);	701	vm_page_unlock(fs.m);
699	fs.m = NULL;	702	fs.m = NULL;
700	unlock_and_deallocate(&fs);	703	unlock_and_deallocate(&fs);
		704	if (rv != VM_PAGER_ERROR) printf("pid %d kpf 4\n", curproc->p_pid);
701	return ((rv == VM_PAGER_ERROR) ? KERN_FAILURE : KERN_PROTECTION_FAILURE);	705	return ((rv == VM_PAGER_ERROR) ? KERN_FAILURE : KERN_PROTECTION_FAILURE);
702	}	706	}
703	if (fs.object != fs.first_object) {	707	if (fs.object != fs.first_object) {

Lines 4011-4016 RetryLookup:; Link Here

(-)b/sys/vm/vm_map.c (+3 lines)
4011	prot = entry->protection;	4011	prot = entry->protection;
4012	fault_type &= (VM_PROT_READ\|VM_PROT_WRITE\|VM_PROT_EXECUTE);	4012	fault_type &= (VM_PROT_READ\|VM_PROT_WRITE\|VM_PROT_EXECUTE);
4013	if ((fault_type & prot) != fault_type \|\| prot == VM_PROT_NONE) {	4013	if ((fault_type & prot) != fault_type \|\| prot == VM_PROT_NONE) {
		4014	printf("pid %d kpf 5 %x %x\n", curproc->p_pid, fault_type, prot);
4014	vm_map_unlock_read(map);	4015	vm_map_unlock_read(map);
4015	return (KERN_PROTECTION_FAILURE);	4016	return (KERN_PROTECTION_FAILURE);
4016	}	4017	}
Lines 4022-4027 RetryLookup:; Link Here
4022	(entry->max_protection & VM_PROT_WRITE) == 0 &&	4023	(entry->max_protection & VM_PROT_WRITE) == 0 &&
4023	(entry->eflags & MAP_ENTRY_COW) == 0) {	4024	(entry->eflags & MAP_ENTRY_COW) == 0) {
4024	vm_map_unlock_read(map);	4025	vm_map_unlock_read(map);
		4026	printf("pid %d kpf 6\n", curproc->p_pid);
4025	return (KERN_PROTECTION_FAILURE);	4027	return (KERN_PROTECTION_FAILURE);
4026	}	4028	}
4027		4029
Lines 4169-4174 vm_map_lookup_locked(vm_map_t var_map, / IN/OUT */ Link Here
4169	*/	4171	*/
4170	prot = entry->protection;	4172	prot = entry->protection;
4171	fault_type &= VM_PROT_READ \| VM_PROT_WRITE \| VM_PROT_EXECUTE;	4173	fault_type &= VM_PROT_READ \| VM_PROT_WRITE \| VM_PROT_EXECUTE;
		4174	if ((fault_type & prot) != fault_type) printf("pid %d kpf 7 %x %x\n", curproc->p_pid, fault_type, prot);
4172	if ((fault_type & prot) != fault_type)	4175	if ((fault_type & prot) != fault_type)
4173	return (KERN_PROTECTION_FAILURE);	4176	return (KERN_PROTECTION_FAILURE);
4174		4177