From: Oleg Nesterov <oleg@redhat.com>
Date: Wed, 26 May 2010 21:42:53 +0000 (-0700)
Subject: ptrace: PTRACE_GETFDPIC: fix the unsafe usage of child->mm
X-Git-Tag: upstream/snapshot3+hdmi~14280
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e0129ef91ed758c06b6557c36124acfb2e1c7305;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git

ptrace: PTRACE_GETFDPIC: fix the unsafe usage of child->mm

Now that Mike Frysinger unified the FDPIC ptrace code, we can fix the
unsafe usage of child->mm in ptrace_request(PTRACE_GETFDPIC).

We have the reference to task_struct, and ptrace_check_attach() verified
the tracee is stopped.  But nothing can protect from SIGKILL after that,
we must not assume child->mm != NULL.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Mike Frysinger <vapier.adi@gmail.com>
Acked-by: David Howells <dhowells@redhat.com>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: Greg Ungerer <gerg@snapgear.com>
Acked-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 4b4f720..74a3d69 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -596,18 +596,24 @@ int ptrace_request(struct task_struct *child, long request,
 
 #ifdef CONFIG_BINFMT_ELF_FDPIC
 	case PTRACE_GETFDPIC: {
+		struct mm_struct *mm = get_task_mm(child);
 		unsigned long tmp = 0;
 
+		ret = -ESRCH;
+		if (!mm)
+			break;
+
 		switch (addr) {
 		case PTRACE_GETFDPIC_EXEC:
-			tmp = child->mm->context.exec_fdpic_loadmap;
+			tmp = mm->context.exec_fdpic_loadmap;
 			break;
 		case PTRACE_GETFDPIC_INTERP:
-			tmp = child->mm->context.interp_fdpic_loadmap;
+			tmp = mm->context.interp_fdpic_loadmap;
 			break;
 		default:
 			break;
 		}
+		mmput(mm);
 
 		ret = put_user(tmp, (unsigned long __user *) data);
 		break;