releases/4.4.133/proc-read-mm-s-arg-env-_-start-end-with-mmap-semaphore-taken.patch

   1 From a3b609ef9f8b1dbfe97034ccad6cd3fe71fbe7ab Mon Sep 17 00:00:00 2001
   2 From: Mateusz Guzik <mguzik@redhat.com>
   3 Date: Wed, 20 Jan 2016 15:01:05 -0800
   4 Subject: proc read mm's {arg,env}_{start,end} with mmap semaphore taken.
   5
   6 From: Mateusz Guzik <mguzik@redhat.com>
   7
   8 commit a3b609ef9f8b1dbfe97034ccad6cd3fe71fbe7ab upstream.
   9
  10 Only functions doing more than one read are modified.  Consumeres
  11 happened to deal with possibly changing data, but it does not seem like
  12 a good thing to rely on.
  13
  14 Signed-off-by: Mateusz Guzik <mguzik@redhat.com>
  15 Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
  16 Cc: Alexey Dobriyan <adobriyan@gmail.com>
  17 Cc: Jarod Wilson <jarod@redhat.com>
  18 Cc: Jan Stancek <jstancek@redhat.com>
  19 Cc: Al Viro <viro@zeniv.linux.org.uk>
  20 Cc: Anshuman Khandual <anshuman.linux@gmail.com>
  21 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  22 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24
  25 ---
  26  fs/proc/base.c |   13 ++++++++++---
  27  mm/util.c      |   16 ++++++++++++----
  28  2 files changed, 22 insertions(+), 7 deletions(-)
  29
  30 --- a/fs/proc/base.c
  31 +++ b/fs/proc/base.c
  32 @@ -953,6 +953,7 @@ static ssize_t environ_read(struct file
  33         unsigned long src = *ppos;
  34         int ret = 0;
  35         struct mm_struct *mm = file->private_data;
  36 +       unsigned long env_start, env_end;
  37
  38         /* Ensure the process spawned far enough to have an environment. */
  39         if (!mm || !mm->env_end)
  40 @@ -965,19 +966,25 @@ static ssize_t environ_read(struct file
  41         ret = 0;
  42         if (!atomic_inc_not_zero(&mm->mm_users))
  43                 goto free;
  44 +
  45 +       down_read(&mm->mmap_sem);
  46 +       env_start = mm->env_start;
  47 +       env_end = mm->env_end;
  48 +       up_read(&mm->mmap_sem);
  49 +
  50         while (count > 0) {
  51                 size_t this_len, max_len;
  52                 int retval;
  53
  54 -               if (src >= (mm->env_end - mm->env_start))
  55 +               if (src >= (env_end - env_start))
  56                         break;
  57
  58 -               this_len = mm->env_end - (mm->env_start + src);
  59 +               this_len = env_end - (env_start + src);
  60
  61                 max_len = min_t(size_t, PAGE_SIZE, count);
  62                 this_len = min(max_len, this_len);
  63
  64 -               retval = access_remote_vm(mm, (mm->env_start + src),
  65 +               retval = access_remote_vm(mm, (env_start + src),
  66                         page, this_len, 0);
  67
  68                 if (retval <= 0) {
  69 --- a/mm/util.c
  70 +++ b/mm/util.c
  71 @@ -428,17 +428,25 @@ int get_cmdline(struct task_struct *task
  72         int res = 0;
  73         unsigned int len;
  74         struct mm_struct *mm = get_task_mm(task);
  75 +       unsigned long arg_start, arg_end, env_start, env_end;
  76         if (!mm)
  77                 goto out;
  78         if (!mm->arg_end)
  79                 goto out_mm;    /* Shh! No looking before we're done */
  80
  81 -       len = mm->arg_end - mm->arg_start;
  82 +       down_read(&mm->mmap_sem);
  83 +       arg_start = mm->arg_start;
  84 +       arg_end = mm->arg_end;
  85 +       env_start = mm->env_start;
  86 +       env_end = mm->env_end;
  87 +       up_read(&mm->mmap_sem);
  88 +
  89 +       len = arg_end - arg_start;
  90
  91         if (len > buflen)
  92                 len = buflen;
  93
  94 -       res = access_process_vm(task, mm->arg_start, buffer, len, 0);
  95 +       res = access_process_vm(task, arg_start, buffer, len, 0);
  96
  97         /*
  98          * If the nul at the end of args has been overwritten, then
  99 @@ -449,10 +457,10 @@ int get_cmdline(struct task_struct *task
 100                 if (len < res) {
 101                         res = len;
 102                 } else {
 103 -                       len = mm->env_end - mm->env_start;
 104 +                       len = env_end - env_start;
 105                         if (len > buflen - res)
 106                                 len = buflen - res;
 107 -                       res += access_process_vm(task, mm->env_start,
 108 +                       res += access_process_vm(task, env_start,
 109                                                  buffer+res, len, 0);
 110                         res = strnlen(buffer, res);
 111                 }