Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9bcf73f4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of... 

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  mm_for_maps: take ->cred_guard_mutex to fix the race with exec
  mm_for_maps: shift down_read(mmap_sem) to the caller
  mm_for_maps: simplify, use ptrace_may_access()
parents 2c661a66 704b836c

fs/proc/base.c

+12 −15
Original line number Diff line number Diff line
@@ -234,23 +234,20 @@ static int check_mem_permission(struct task_struct *task) 


struct mm_struct *mm_for_maps(struct task_struct *task)

{

	struct mm_struct *mm = get_task_mm(task);

	if (!mm)

	struct mm_struct *mm;



	if (mutex_lock_killable(&task->cred_guard_mutex))

		return NULL;

	down_read(&mm->mmap_sem);

	task_lock(task);

	if (task->mm != mm)

		goto out;

	if (task->mm != current->mm &&

	    __ptrace_may_access(task, PTRACE_MODE_READ) < 0)

		goto out;

	task_unlock(task);

	return mm;

out:

	task_unlock(task);

	up_read(&mm->mmap_sem);



	mm = get_task_mm(task);

	if (mm && mm != current->mm &&

			!ptrace_may_access(task, PTRACE_MODE_READ)) {

		mmput(mm);

	return NULL;

		mm = NULL;

	}

	mutex_unlock(&task->cred_guard_mutex);



	return mm;

}



static int proc_pid_cmdline(struct task_struct *task, char * buffer)

fs/proc/task_mmu.c

+1 −0
Original line number Diff line number Diff line
@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) 
	mm = mm_for_maps(priv->task);

	if (!mm)

		return NULL;

	down_read(&mm->mmap_sem);



	tail_vma = get_gate_vma(priv->task);

	priv->tail_vma = tail_vma;

fs/proc/task_nommu.c

+1 −0
Original line number Diff line number Diff line
@@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) 
		priv->task = NULL;

		return NULL;

	}

	down_read(&mm->mmap_sem);



	/* start from the Nth VMA */

	for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))