lkml.org 
[lkml]   [2010]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH -mm 1/1] ptrace: PTRACE_GETFDPIC: fix the unsafe usage of child->mm
Now that Mike Frysinger unified the FDPIC ptrace code, we can fix
the unsafe usage of child->mm in ptrace_request(PTRACE_GETFDPIC).

We have the reference to task_struct, and ptrace_check_attach()
verified the tracee is stopped. But nothing can protect from
SIGKILL after that, we must not assume child->mm != NULL.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
---

kernel/ptrace.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)

--- 34-rc1/kernel/ptrace.c~PTRACE_FDPIC 2010-05-22 18:04:47.000000000 +0200
+++ 34-rc1/kernel/ptrace.c 2010-05-22 18:35:35.000000000 +0200
@@ -598,18 +598,24 @@ int ptrace_request(struct task_struct *c

#ifdef CONFIG_BINFMT_ELF_FDPIC
case PTRACE_GETFDPIC: {
+ struct mm_struct *mm = get_task_mm(child);
unsigned long tmp = 0;

+ ret = -ESRCH;
+ if (!mm)
+ break;
+
switch (addr) {
case PTRACE_GETFDPIC_EXEC:
- tmp = child->mm->context.exec_fdpic_loadmap;
+ tmp = mm->context.exec_fdpic_loadmap;
break;
case PTRACE_GETFDPIC_INTERP:
- tmp = child->mm->context.interp_fdpic_loadmap;
+ tmp = mm->context.interp_fdpic_loadmap;
break;
default:
break;
}
+ mmput(mm);

ret = put_user(tmp, (unsigned long __user *) data);
break;


\
 
 \ /
  Last update: 2010-05-22 16:57    [W:0.089 / U:10.644 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site