aboutsummaryrefslogtreecommitdiff
path: root/kernel/ptrace.c
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@redhat.com>2010-05-26 14:42:53 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2010-05-27 09:12:44 -0700
commite0129ef91ed758c06b6557c36124acfb2e1c7305 (patch)
treee47392371ed106f2241d18ac6339bedd6c699c9b /kernel/ptrace.c
parent9c1a125921d146f22cf28ff366ff69fd602a0e9b (diff)
downloadlinux-2.6.34-ux500-e0129ef91ed758c06b6557c36124acfb2e1c7305.tar.gz
ptrace: PTRACE_GETFDPIC: fix the unsafe usage of child->mm
Now that Mike Frysinger unified the FDPIC ptrace code, we can fix the unsafe usage of child->mm in ptrace_request(PTRACE_GETFDPIC). We have the reference to task_struct, and ptrace_check_attach() verified the tracee is stopped. But nothing can protect from SIGKILL after that, we must not assume child->mm != NULL. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Mike Frysinger <vapier.adi@gmail.com> Acked-by: David Howells <dhowells@redhat.com> Cc: Paul Mundt <lethal@linux-sh.org> Cc: Greg Ungerer <gerg@snapgear.com> Acked-by: Roland McGrath <roland@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel/ptrace.c')
-rw-r--r--kernel/ptrace.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 4b4f72084d1..74a3d693c19 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -596,18 +596,24 @@ int ptrace_request(struct task_struct *child, long request,
#ifdef CONFIG_BINFMT_ELF_FDPIC
case PTRACE_GETFDPIC: {
+ struct mm_struct *mm = get_task_mm(child);
unsigned long tmp = 0;
+ ret = -ESRCH;
+ if (!mm)
+ break;
+
switch (addr) {
case PTRACE_GETFDPIC_EXEC:
- tmp = child->mm->context.exec_fdpic_loadmap;
+ tmp = mm->context.exec_fdpic_loadmap;
break;
case PTRACE_GETFDPIC_INTERP:
- tmp = child->mm->context.interp_fdpic_loadmap;
+ tmp = mm->context.interp_fdpic_loadmap;
break;
default:
break;
}
+ mmput(mm);
ret = put_user(tmp, (unsigned long __user *) data);
break;