summaryrefslogtreecommitdiff
path: root/fs/proc/task_nommu.c
diff options
context:
space:
mode:
authorAl Viro <viro@ZenIV.linux.org.uk>2008-01-02 17:09:57 +0300
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-01-03 00:13:27 +0300
commit831830b5a2b5d413407adf380ef62fe17d6fcbf2 (patch)
treeb08f54f15374b5b98b0b3bea20a1d2ea8d1f50e0 /fs/proc/task_nommu.c
parentac40532ef0b8649e6f7f83859ea0de1c4ed08a19 (diff)
downloadlinux-831830b5a2b5d413407adf380ef62fe17d6fcbf2.tar.xz
restrict reading from /proc/<pid>/maps to those who share ->mm or can ptrace pid
Contents of /proc/*/maps is sensitive and may become sensitive after open() (e.g. if target originally shares our ->mm and later does exec on suid-root binary). Check at read() (actually, ->start() of iterator) time that mm_struct we'd grabbed and locked is - still the ->mm of target - equal to reader's ->mm or the target is ptracable by reader. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Acked-by: Rik van Riel <riel@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/proc/task_nommu.c')
-rw-r--r--fs/proc/task_nommu.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index d8b8c7183c24..1932c2ca3457 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -165,15 +165,13 @@ static void *m_start(struct seq_file *m, loff_t *pos)
if (!priv->task)
return NULL;
- mm = get_task_mm(priv->task);
+ mm = mm_for_maps(priv->task);
if (!mm) {
put_task_struct(priv->task);
priv->task = NULL;
return NULL;
}
- down_read(&mm->mmap_sem);
-
/* start from the Nth VMA */
for (vml = mm->context.vmlist; vml; vml = vml->next)
if (n-- == 0)