ptrace: PTRACE_GETFDPIC: fix the unsafe usage of child->mm (e0129ef9) · Commits · 戴 / test

Now that Mike Frysinger unified the FDPIC ptrace code, we can fix the unsafe usage of child->mm in ptrace_request(PTRACE_GETFDPIC). We have the reference to task_struct, and ptrace_check_attach() verified the tracee is stopped. But nothing can protect from SIGKILL after that, we must not assume child->mm != NULL. Signed-off-by:

Oleg Nesterov <oleg@redhat.com> Acked-by:

Mike Frysinger <vapier.adi@gmail.com> Acked-by:

David Howells <dhowells@redhat.com> Cc: Paul Mundt <lethal@linux-sh.org> Cc: Greg Ungerer <gerg@snapgear.com> Acked-by:

Roland McGrath <roland@redhat.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

kernel/ptrace.c

+8 −2

Original line number	Original line	Diff line number	Diff line
	@@ -596,18 +596,24 @@ int ptrace_request(struct task_struct *child, long request,

	#ifdef CONFIG_BINFMT_ELF_FDPIC		#ifdef CONFIG_BINFMT_ELF_FDPIC
	case PTRACE_GETFDPIC: {		case PTRACE_GETFDPIC: {
			struct mm_struct *mm = get_task_mm(child);
	unsigned long tmp = 0;		unsigned long tmp = 0;

			ret = -ESRCH;
			if (!mm)
			break;

	switch (addr) {		switch (addr) {
	case PTRACE_GETFDPIC_EXEC:		case PTRACE_GETFDPIC_EXEC:
	tmp = child->mm->context.exec_fdpic_loadmap;		tmp = mm->context.exec_fdpic_loadmap;
	break;		break;
	case PTRACE_GETFDPIC_INTERP:		case PTRACE_GETFDPIC_INTERP:
	tmp = child->mm->context.interp_fdpic_loadmap;		tmp = mm->context.interp_fdpic_loadmap;
	break;		break;
	default:		default:
	break;		break;
	}		}
			mmput(mm);

	ret = put_user(tmp, (unsigned long __user *) data);		ret = put_user(tmp, (unsigned long __user *) data);
	break;		break;

Admin message