Fix pte_modify() bug which allowed mprotect() to change too many bits.

Found by Russell King.

diff --git a/include/asm-ia64/pgtable.h b/include/asm-ia64/pgtable.h
index a538701ac028cc5e77d7872756c3e5b331c86f9b..6f8d7c9287ba162d90cf4954ca3d7cfef45aad9e 100644 (file)
--- a/include/asm-ia64/pgtable.h
+++ b/include/asm-ia64/pgtable.h
@@ -63,7 +63,8 @@
 #define _PAGE_FILE             (1 << 1)                /* see swap & file pte remarks below */
 
 #define _PFN_MASK              _PAGE_PPN_MASK
-#define _PAGE_CHG_MASK         (_PFN_MASK | _PAGE_A | _PAGE_D)
+/* Mask of bits which may be changed by pte_modify(): */
+#define _PAGE_CHG_MASK         _PAGE_AR_MASK
 
 #define _PAGE_SIZE_4K  12
 #define _PAGE_SIZE_8K  13
@@ -230,7 +231,7 @@ ia64_phys_addr_valid (unsigned long addr)
 #define mk_pte(page, pgprot)   pfn_pte(page_to_pfn(page), (pgprot))
 
 #define pte_modify(_pte, newprot) \
-       (__pte((pte_val(_pte) & _PAGE_CHG_MASK) | pgprot_val(newprot)))
+       (__pte((pte_val(_pte) & ~_PAGE_CHG_MASK) | (pgprot_val(newprot) & _PAGE_CHG_MASK)))
 
 #define page_pte_prot(page,prot)       mk_pte(page, prot)
 #define page_pte(page)                 page_pte_prot(page, __pgprot(0))