Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca6b0bf0 authored by Al Viro's avatar Al Viro
Browse files

pagemap: close races with suid execve 



just use mm_for_maps()

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 26ec3c64

fs/proc/base.c

+2 −2
Original line number Diff line number Diff line
@@ -2797,7 +2797,7 @@ static const struct pid_entry tgid_base_stuff[] = { 
#ifdef CONFIG_PROC_PAGE_MONITOR

	REG("clear_refs", S_IWUSR, proc_clear_refs_operations),

	REG("smaps",      S_IRUGO, proc_smaps_operations),

	REG("pagemap",    S_IRUSR, proc_pagemap_operations),

	REG("pagemap",    S_IRUGO, proc_pagemap_operations),

#endif

#ifdef CONFIG_SECURITY

	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
@@ -3133,7 +3133,7 @@ static const struct pid_entry tid_base_stuff[] = { 
#ifdef CONFIG_PROC_PAGE_MONITOR

	REG("clear_refs", S_IWUSR, proc_clear_refs_operations),

	REG("smaps",     S_IRUGO, proc_smaps_operations),

	REG("pagemap",    S_IRUSR, proc_pagemap_operations),

	REG("pagemap",    S_IRUGO, proc_pagemap_operations),

#endif

#ifdef CONFIG_SECURITY

	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),

fs/proc/task_mmu.c

+2 −5
Original line number Diff line number Diff line
@@ -729,7 +729,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, 
		goto out;



	ret = -EACCES;

	if (!ptrace_may_access(task, PTRACE_MODE_READ))

	mm = mm_for_maps(task);

	if (!mm)

		goto out_task;



	ret = -EINVAL;
@@ -742,10 +743,6 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, 
	if (!count)

		goto out_task;



	mm = get_task_mm(task);

	if (!mm)

		goto out_task;



	pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);

	pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);

	ret = -ENOMEM;