Commit 9bcf73f4 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of...

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  mm_for_maps: take ->cred_guard_mutex to fix the race with exec
  mm_for_maps: shift down_read(mmap_sem) to the caller
  mm_for_maps: simplify, use ptrace_may_access()
parents 2c661a66 704b836c
...@@ -234,23 +234,20 @@ static int check_mem_permission(struct task_struct *task) ...@@ -234,23 +234,20 @@ static int check_mem_permission(struct task_struct *task)
struct mm_struct *mm_for_maps(struct task_struct *task) struct mm_struct *mm_for_maps(struct task_struct *task)
{ {
struct mm_struct *mm = get_task_mm(task); struct mm_struct *mm;
if (!mm)
if (mutex_lock_killable(&task->cred_guard_mutex))
return NULL; return NULL;
down_read(&mm->mmap_sem);
task_lock(task); mm = get_task_mm(task);
if (task->mm != mm) if (mm && mm != current->mm &&
goto out; !ptrace_may_access(task, PTRACE_MODE_READ)) {
if (task->mm != current->mm &&
__ptrace_may_access(task, PTRACE_MODE_READ) < 0)
goto out;
task_unlock(task);
return mm;
out:
task_unlock(task);
up_read(&mm->mmap_sem);
mmput(mm); mmput(mm);
return NULL; mm = NULL;
}
mutex_unlock(&task->cred_guard_mutex);
return mm;
} }
static int proc_pid_cmdline(struct task_struct *task, char * buffer) static int proc_pid_cmdline(struct task_struct *task, char * buffer)
......
...@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) ...@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
mm = mm_for_maps(priv->task); mm = mm_for_maps(priv->task);
if (!mm) if (!mm)
return NULL; return NULL;
down_read(&mm->mmap_sem);
tail_vma = get_gate_vma(priv->task); tail_vma = get_gate_vma(priv->task);
priv->tail_vma = tail_vma; priv->tail_vma = tail_vma;
......
...@@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) ...@@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
priv->task = NULL; priv->task = NULL;
return NULL; return NULL;
} }
down_read(&mm->mmap_sem);
/* start from the Nth VMA */ /* start from the Nth VMA */
for (p = rb_first(&mm->mm_rb); p; p = rb_next(p)) for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment