diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2011-02-15 22:04:37 -0500 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2011-03-23 16:36:50 -0400 |
| commit | ca6b0bf0e086513b9ee5efc0aa5770ecb57778af (patch) | |
| tree | 4fec50b38253288746ac4b4ea6d4bf5216b0c53b /fs | |
| parent | 26ec3c646e75ce7a69fda429d68fcbdcd5eacc62 (diff) | |
| download | kernel_samsung_tuna-ca6b0bf0e086513b9ee5efc0aa5770ecb57778af.zip kernel_samsung_tuna-ca6b0bf0e086513b9ee5efc0aa5770ecb57778af.tar.gz kernel_samsung_tuna-ca6b0bf0e086513b9ee5efc0aa5770ecb57778af.tar.bz2 | |
pagemap: close races with suid execve
just use mm_for_maps()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/proc/base.c | 4 | ||||
| -rw-r--r-- | fs/proc/task_mmu.c | 7 |
2 files changed, 4 insertions, 7 deletions
diff --git a/fs/proc/base.c b/fs/proc/base.c index b77236d..df73573 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2797,7 +2797,7 @@ static const struct pid_entry tgid_base_stuff[] = { #ifdef CONFIG_PROC_PAGE_MONITOR REG("clear_refs", S_IWUSR, proc_clear_refs_operations), REG("smaps", S_IRUGO, proc_smaps_operations), - REG("pagemap", S_IRUSR, proc_pagemap_operations), + REG("pagemap", S_IRUGO, proc_pagemap_operations), #endif #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), @@ -3133,7 +3133,7 @@ static const struct pid_entry tid_base_stuff[] = { #ifdef CONFIG_PROC_PAGE_MONITOR REG("clear_refs", S_IWUSR, proc_clear_refs_operations), REG("smaps", S_IRUGO, proc_smaps_operations), - REG("pagemap", S_IRUSR, proc_pagemap_operations), + REG("pagemap", S_IRUGO, proc_pagemap_operations), #endif #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 60b9148..c966413 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -729,7 +729,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, goto out; ret = -EACCES; - if (!ptrace_may_access(task, PTRACE_MODE_READ)) + mm = mm_for_maps(task); + if (!mm) goto out_task; ret = -EINVAL; @@ -742,10 +743,6 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, if (!count) goto out_task; - mm = get_task_mm(task); - if (!mm) - goto out_task; - pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT); pm.buffer = kmalloc(pm.len, GFP_TEMPORARY); ret = -ENOMEM; |