Thread (6 messages) 6 messages, 4 authors, 2016-03-01

Patch "proc: Fix ptrace-based permission checks for accessing task maps" has been added to the 3.10-stable tree

From: <gregkh@linuxfoundation.org>
Date: 2016-03-01 08:15:39

This is a note to let you know that I've just added the patch titled

    proc: Fix ptrace-based permission checks for accessing task maps

to the 3.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.

From undefined@pobox.com  Mon Feb 29 22:02:13 2016
From: Corey Wright <redacted>
Date: Sun, 28 Feb 2016 02:42:39 -0600
Subject: proc: Fix ptrace-based permission checks for accessing task maps
To: stable@vger.kernel.org
Cc: Jann Horn <redacted>
Message-ID: [ref]

From: Corey Wright <redacted>

Modify mm_access() calls in fs/proc/task_mmu.c and fs/proc/task_nommu.c to
have the mode include PTRACE_MODE_FSCREDS so accessing /proc/pid/maps and
/proc/pid/pagemap is not denied to all users.

In backporting upstream commit caaee623 to pre-3.18 kernel versions it was
overlooked that mm_access() is used in fs/proc/task_*mmu.c as those calls
were removed in 3.18 (by upstream commit 29a40ace) and did not exist at the
time of the original commit.

Signed-off-by: Corey Wright <redacted>
Acked-by: Jann Horn <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/task_mmu.c   |    4 ++--
 fs/proc/task_nommu.c |    2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -170,7 +170,7 @@ static void *m_start(struct seq_file *m,
 	if (!priv->task)
 		return ERR_PTR(-ESRCH);
 
-	mm = mm_access(priv->task, PTRACE_MODE_READ);
+	mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
 	if (!mm || IS_ERR(mm))
 		return mm;
 	down_read(&mm->mmap_sem);
@@ -1044,7 +1044,7 @@ static ssize_t pagemap_read(struct file
 	if (!pm.buffer)
 		goto out_task;
 
-	mm = mm_access(task, PTRACE_MODE_READ);
+	mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
 	ret = PTR_ERR(mm);
 	if (!mm || IS_ERR(mm))
 		goto out_free;
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -223,7 +223,7 @@ static void *m_start(struct seq_file *m,
 	if (!priv->task)
 		return ERR_PTR(-ESRCH);
 
-	mm = mm_access(priv->task, PTRACE_MODE_READ);
+	mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
 	if (!mm || IS_ERR(mm)) {
 		put_task_struct(priv->task);
 		priv->task = NULL;

Patches currently in stable-queue which might be from undefined@pobox.com are

queue-3.10/proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help