Re: [PATCH -mm 1/1] ptrace: PTRACE_GETFDPIC: fix the unsafe usageof child->mm
From: Oleg Nesterov
Date: Tue May 25 2010 - 06:25:22 EST
On 05/25, David Howells wrote:
>
> Roland McGrath <roland@xxxxxxxxxx> wrote:
>
> > The mm pointer is only used by these uncommon ptrace operations
>
> Like PEEKTEXT and POKETEXT?
They use access_process_vm().
According to grep, mm is only use to read a couple of members.
Perhaps can even add the simple helper
struct mm_xxx {
unsigned long start_code, end_code, start_data, end_data;
... some more ...
};
int get_mm_xxx(struct task_struct *tracee, struct mm_xxx *mm_xxx)
{
struct mm_struct *mm = get_task_mm(tracee);
...
}
Except:
- arch/um/kernel/ptrace.c PTRACE_SWITCH_MM does something
really strange
- arch/blackfin/kernel/ptrace.c:is_user_addr_valid()
needs mmap_sem around find_vma()
The lockless access to mm->context.sram_list doesn't look
safe to me.
If we add get_task_mm() - this protects us against
destroy_context() only. What is the tracee's sub-thread
does sys_sram_alloc() or sys_sram_free() in parallel?
Oleg.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/