Commit ca6b0bf0 authored by Al Viro's avatar Al Viro

pagemap: close races with suid execve

just use mm_for_maps()
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 26ec3c64
...@@ -2797,7 +2797,7 @@ static const struct pid_entry tgid_base_stuff[] = { ...@@ -2797,7 +2797,7 @@ static const struct pid_entry tgid_base_stuff[] = {
#ifdef CONFIG_PROC_PAGE_MONITOR #ifdef CONFIG_PROC_PAGE_MONITOR
REG("clear_refs", S_IWUSR, proc_clear_refs_operations), REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
REG("smaps", S_IRUGO, proc_smaps_operations), REG("smaps", S_IRUGO, proc_smaps_operations),
REG("pagemap", S_IRUSR, proc_pagemap_operations), REG("pagemap", S_IRUGO, proc_pagemap_operations),
#endif #endif
#ifdef CONFIG_SECURITY #ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
...@@ -3133,7 +3133,7 @@ static const struct pid_entry tid_base_stuff[] = { ...@@ -3133,7 +3133,7 @@ static const struct pid_entry tid_base_stuff[] = {
#ifdef CONFIG_PROC_PAGE_MONITOR #ifdef CONFIG_PROC_PAGE_MONITOR
REG("clear_refs", S_IWUSR, proc_clear_refs_operations), REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
REG("smaps", S_IRUGO, proc_smaps_operations), REG("smaps", S_IRUGO, proc_smaps_operations),
REG("pagemap", S_IRUSR, proc_pagemap_operations), REG("pagemap", S_IRUGO, proc_pagemap_operations),
#endif #endif
#ifdef CONFIG_SECURITY #ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
......
...@@ -729,7 +729,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, ...@@ -729,7 +729,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
goto out; goto out;
ret = -EACCES; ret = -EACCES;
if (!ptrace_may_access(task, PTRACE_MODE_READ)) mm = mm_for_maps(task);
if (!mm)
goto out_task; goto out_task;
ret = -EINVAL; ret = -EINVAL;
...@@ -742,10 +743,6 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, ...@@ -742,10 +743,6 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
if (!count) if (!count)
goto out_task; goto out_task;
mm = get_task_mm(task);
if (!mm)
goto out_task;
pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT); pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
pm.buffer = kmalloc(pm.len, GFP_TEMPORARY); pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
ret = -ENOMEM; ret = -ENOMEM;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment