linux-kernel - Re: [PATCH RESEND] Fix race in process_vm_rw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120130150922.GA17643@redhat.com>
Date:	Mon, 30 Jan 2012 16:09:22 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Christopher Yeoh <cyeoh@....ibm.com>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND] Fix race in process_vm_rw_core

On 01/30, Christopher Yeoh wrote:
>
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -198,7 +198,7 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
>  	return result;
>  }
>
> -static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
> +struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)

This is not enough, we should move it outside of fs/proc/, otherwise
the kernel can't be compiled without CONFIG_PROC.

> --- a/mm/process_vm_access.c
> +++ b/mm/process_vm_access.c
> @@ -298,23 +298,15 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
>  		goto free_proc_pages;
>  	}
>  
> -	task_lock(task);
> -	if (__ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
> -		task_unlock(task);
> -		rc = -EPERM;
> -		goto put_task_struct;
> -	}
> -	mm = task->mm;
> -
> -	if (!mm || (task->flags & PF_KTHREAD)) {
> -		task_unlock(task);
> -		rc = -EINVAL;
> +	mm = mm_access(task, PTRACE_MODE_ATTACH);
> +	if (!mm || IS_ERR(mm)) {
> +		if (!mm)
> +			rc = -EINVAL;
> +		else
> +			rc = -EPERM;
>  		goto put_task_struct;
>  	}
>  
> -	atomic_inc(&mm->mm_users);
> -	task_unlock(task);
> -

Looks obviously correct.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/