In a copy-on-write situation a page from a lower cache must always be

mapped fully read-only (for both kernel and userland). Previously a
kernel read access to a yet unmapped r/w accessible userland address
would cause the page from the lower cache to be mapped with write
permission for userland (on x86 also for the kernel) thus e.g.
allowing a fork()ed child process to write to the parent process'
memory.

Fixes bugs #113 and #928.



git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@20402 a95241bf-73f2-0310-859d-f6bbb57e9c96

src/system/kernel/vm/vm.cpp

@@ -3474,7 +3474,7 @@ vm_soft_fault(addr_t originalAddress, bool isWrite, bool isUser)
 		// mapped in read-only, so that we cannot overwrite someone else's data (copy-on-write)
 		uint32 newProtection = area->protection;
 		if (page->cache != topCacheRef->cache && !isWrite)
-			newProtection &= ~(isUser ? B_WRITE_AREA : B_KERNEL_WRITE_AREA);
+			newProtection &= ~(B_WRITE_AREA | B_KERNEL_WRITE_AREA);
 
 		vm_map_page(area, page, address, newProtection);
 	}