diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-03-31 13:37:43 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-04-21 15:41:34 +0000 |
| commit | ca87c0b8e396fff01d55f1985c2556934c35a950 (patch) | |
| tree | 5ca4b9746ecb10b11c330734133c27fe1f3646f6 /lib/libsys/x86/pkru.3 | |
| parent | 093903a8d4c05d1adff79895a52a3e3009ff07a7 (diff) | |
pkru: Fix handling of 1GB largepage mappings
pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS
set. More generally, the SET_PKRU and CLEAR_PKRU sysarch
implementations did not check whether the request covers a "boundary" vm
map entry. Fix this, add the missing PG_PS test, and add some tests.
Approved by: so
Security: FreeBSD-SA-26:11.amd64
Security: CVE-2026-6386
Reported by: Nicholas Carlini <npc@anthropic.com>
Reviewed by: kib, alc
Differential Revision: https://reviews.freebsd.org/D56184
Diffstat (limited to 'lib/libsys/x86/pkru.3')
| -rw-r--r-- | lib/libsys/x86/pkru.3 | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/libsys/x86/pkru.3 b/lib/libsys/x86/pkru.3 index 75580953e6ed..45b7093bd094 100644 --- a/lib/libsys/x86/pkru.3 +++ b/lib/libsys/x86/pkru.3 @@ -179,6 +179,9 @@ The supplied argument for .Fn x86_pkru_protect_range has reserved bits set. +.It Bq Er EINVAL +The range of the request partially covers a mapping of an object created by +.Xr shm_create_largepage 3 . .It Bq Er EFAULT The supplied address range does not completely fit into the user-managed address range. |