diff mbox

[lucid,lucid/fsl-imx51,CVE,1/5] pagemap: close races with suid execve

Message ID 1311254026-29719-3-git-send-email-apw@canonical.com
State New
Headers show

Commit Message

Andy Whitcroft July 21, 2011, 1:13 p.m. UTC 
From: Al Viro <viro@zeniv.linux.org.uk>

just use mm_for_maps()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

(backported from commit ca6b0bf0e086513b9ee5efc0aa5770ecb57778af)
CVE-2011-1020
BugLink: http://bugs.launchpad.net/bugs/813026
Signed-off-by: Andy Whitcroft <apw@canonical.com>
---
 fs/proc/base.c     |    4 ++--
 fs/proc/task_mmu.c |    7 ++-----
 2 files changed, 4 insertions(+), 7 deletions(-)
diff mbox

Patch

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 3d09a10..41b2428 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2539,7 +2539,7 @@  static const struct pid_entry tgid_base_stuff[] = {
 #ifdef CONFIG_PROC_PAGE_MONITOR
 	REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
 	REG("smaps",      S_IRUGO, proc_smaps_operations),
-	REG("pagemap",    S_IRUSR, proc_pagemap_operations),
+	REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
 	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
@@ -2877,7 +2877,7 @@  static const struct pid_entry tid_base_stuff[] = {
 #ifdef CONFIG_PROC_PAGE_MONITOR
 	REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
 	REG("smaps",     S_IRUGO, proc_smaps_operations),
-	REG("pagemap",    S_IRUSR, proc_pagemap_operations),
+	REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
 	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 3b7b82a..6e7b065 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -682,7 +682,8 @@  static ssize_t pagemap_read(struct file *file, char __user *buf,
 		goto out;
 
 	ret = -EACCES;
-	if (!ptrace_may_access(task, PTRACE_MODE_READ))
+	mm = mm_for_maps(task);
+	if (!mm)
 		goto out_task;
 
 	ret = -EINVAL;
@@ -695,10 +696,6 @@  static ssize_t pagemap_read(struct file *file, char __user *buf,
 	if (!count)
 		goto out_task;
 
-	mm = get_task_mm(task);
-	if (!mm)
-		goto out_task;
-
 
 	uaddr = (unsigned long)buf & PAGE_MASK;
 	uend = (unsigned long)(buf + count);