diff options
| author | Christopher Yeoh <cyeoh@au1.ibm.com> | 2012-02-02 11:34:09 +1030 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-02-02 12:55:17 -0800 |
| commit | 8cdb878dcb359fd1137e9abdee9322f5e9bcfdf8 (patch) | |
| tree | 146afc01f3c1d7cbc944328484d077032bc53bfd /kernel/fork.c | |
| parent | 24b36da33c64368775f4ef9386d44dce1d2bc8cf (diff) | |
| download | kernel_goldelico_gta04-8cdb878dcb359fd1137e9abdee9322f5e9bcfdf8.zip kernel_goldelico_gta04-8cdb878dcb359fd1137e9abdee9322f5e9bcfdf8.tar.gz kernel_goldelico_gta04-8cdb878dcb359fd1137e9abdee9322f5e9bcfdf8.tar.bz2 | |
Fix race in process_vm_rw_core
This fixes the race in process_vm_core found by Oleg (see
http://article.gmane.org/gmane.linux.kernel/1235667/
for details).
This has been updated since I last sent it as the creation of the new
mm_access() function did almost exactly the same thing as parts of the
previous version of this patch did.
In order to use mm_access() even when /proc isn't enabled, we move it to
kernel/fork.c where other related process mm access functions already
are.
Signed-off-by: Chris Yeoh <yeohc@au1.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel/fork.c')
| -rw-r--r-- | kernel/fork.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/kernel/fork.c b/kernel/fork.c index 051f090..1b2ef3c 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -647,6 +647,26 @@ struct mm_struct *get_task_mm(struct task_struct *task) } EXPORT_SYMBOL_GPL(get_task_mm); +struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) +{ + struct mm_struct *mm; + int err; + + err = mutex_lock_killable(&task->signal->cred_guard_mutex); + if (err) + return ERR_PTR(err); + + mm = get_task_mm(task); + if (mm && mm != current->mm && + !ptrace_may_access(task, mode)) { + mmput(mm); + mm = ERR_PTR(-EACCES); + } + mutex_unlock(&task->signal->cred_guard_mutex); + + return mm; +} + /* Please note the differences between mmput and mm_release. * mmput is called whenever we stop holding onto a mm_struct, * error success whatever. |