Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: mm_for_maps: take ->cred_guard_mutex to fix the race with exec mm_for_maps: shift down_read(mmap_sem) to the caller mm_for_maps: simplify, use ptrace_may_access()
This commit is contained in:
commit
9bcf73f482
|
@ -234,23 +234,20 @@ static int check_mem_permission(struct task_struct *task)
|
|||
|
||||
struct mm_struct *mm_for_maps(struct task_struct *task)
|
||||
{
|
||||
struct mm_struct *mm = get_task_mm(task);
|
||||
if (!mm)
|
||||
struct mm_struct *mm;
|
||||
|
||||
if (mutex_lock_killable(&task->cred_guard_mutex))
|
||||
return NULL;
|
||||
down_read(&mm->mmap_sem);
|
||||
task_lock(task);
|
||||
if (task->mm != mm)
|
||||
goto out;
|
||||
if (task->mm != current->mm &&
|
||||
__ptrace_may_access(task, PTRACE_MODE_READ) < 0)
|
||||
goto out;
|
||||
task_unlock(task);
|
||||
|
||||
mm = get_task_mm(task);
|
||||
if (mm && mm != current->mm &&
|
||||
!ptrace_may_access(task, PTRACE_MODE_READ)) {
|
||||
mmput(mm);
|
||||
mm = NULL;
|
||||
}
|
||||
mutex_unlock(&task->cred_guard_mutex);
|
||||
|
||||
return mm;
|
||||
out:
|
||||
task_unlock(task);
|
||||
up_read(&mm->mmap_sem);
|
||||
mmput(mm);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static int proc_pid_cmdline(struct task_struct *task, char * buffer)
|
||||
|
|
|
@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
|
|||
mm = mm_for_maps(priv->task);
|
||||
if (!mm)
|
||||
return NULL;
|
||||
down_read(&mm->mmap_sem);
|
||||
|
||||
tail_vma = get_gate_vma(priv->task);
|
||||
priv->tail_vma = tail_vma;
|
||||
|
|
|
@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
|
|||
priv->task = NULL;
|
||||
return NULL;
|
||||
}
|
||||
down_read(&mm->mmap_sem);
|
||||
|
||||
/* start from the Nth VMA */
|
||||
for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
|
||||
|
|
Loading…
Reference in New Issue