GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-26 16:41:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

ptrace: PTRACE_GETFDPIC: fix the unsafe usage of child->mm

Browse source 
Now that Mike Frysinger unified the FDPIC ptrace code, we can fix the
unsafe usage of child->mm in ptrace_request(PTRACE_GETFDPIC).

We have the reference to task_struct, and ptrace_check_attach() verified
the tracee is stopped.  But nothing can protect from SIGKILL after that,
we must not assume child->mm != NULL.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Mike Frysinger <vapier.adi@gmail.com>
Acked-by: David Howells <dhowells@redhat.com>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: Greg Ungerer <gerg@snapgear.com>
Acked-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Oleg Nesterov 2010-05-26 14:42:53 -07:00 • committed by Linus Torvalds
parent 9c1a125921
commit e0129ef91e
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
kernel/ptrace.c
View file

@ -596,18 +596,24 @@ int ptrace_request(struct task_struct *child, long request,
#ifdef CONFIG_BINFMT_ELF_FDPIC #ifdef CONFIG_BINFMT_ELF_FDPIC
case PTRACE_GETFDPIC: { case PTRACE_GETFDPIC: {
struct mm_struct *mm = get_task_mm(child);
unsigned long tmp = 0; unsigned long tmp = 0;
ret = -ESRCH;
if (!mm)
break;
switch (addr) { switch (addr) {
case PTRACE_GETFDPIC_EXEC: case PTRACE_GETFDPIC_EXEC:
tmp = child->mm->context.exec_fdpic_loadmap; tmp = mm->context.exec_fdpic_loadmap;
break; break;
case PTRACE_GETFDPIC_INTERP: case PTRACE_GETFDPIC_INTERP:
tmp = child->mm->context.interp_fdpic_loadmap; tmp = mm->context.interp_fdpic_loadmap;
break; break;
default: default:
break; break;
} }
mmput(mm);
ret = put_user(tmp, (unsigned long __user *) data); ret = put_user(tmp, (unsigned long __user *) data);
break; break;