fs, proc: fix ABBA deadlock in case of execution attempt of map_files/ entries

[linux-flexiantxendom0-3.2.10.git] / fs / proc / base.c

diff --git a/fs/proc/base.c b/fs/proc/base.c
index d9512bd..8e139c9 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -198,26 +198,6 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
        return result;
 }
 
-static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
-{
-       struct mm_struct *mm;
-       int err;
-
-       err =  mutex_lock_killable(&task->signal->cred_guard_mutex);
-       if (err)
-               return ERR_PTR(err);
-
-       mm = get_task_mm(task);
-       if (mm && mm != current->mm &&
-                       !ptrace_may_access(task, mode)) {
-               mmput(mm);
-               mm = ERR_PTR(-EACCES);
-       }
-       mutex_unlock(&task->signal->cred_guard_mutex);
-
-       return mm;
-}
-
 struct mm_struct *mm_for_maps(struct task_struct *task)
 {
        return mm_access(task, PTRACE_MODE_READ);
@@ -1330,8 +1310,7 @@ sched_autogroup_write(struct file *file, const char __user *buf,
        if (!p)
                return -ESRCH;
 
-       err = nice;
-       err = proc_sched_autogroup_set_nice(p, &err);
+       err = proc_sched_autogroup_set_nice(p, nice);
        if (err)
                count = err;
 
@@ -1774,7 +1753,7 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
 
                        fdt = files_fdtable(files);
                        f_flags = file->f_flags & ~O_CLOEXEC;
-                       if (FD_ISSET(fd, fdt->close_on_exec))
+                       if (close_on_exec(fd, fdt))
                                f_flags |= O_CLOEXEC;
 
                        if (path) {
@@ -2198,16 +2177,16 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
                goto out;
 
        result = ERR_PTR(-EACCES);
-       if (lock_trace(task))
+       if (!ptrace_may_access(task, PTRACE_MODE_READ))
                goto out_put_task;
 
        result = ERR_PTR(-ENOENT);
        if (dname_to_vma_addr(dentry, &vm_start, &vm_end))
-               goto out_unlock;
+               goto out_put_task;
 
        mm = get_task_mm(task);
        if (!mm)
-               goto out_unlock;
+               goto out_put_task;
 
        down_read(&mm->mmap_sem);
        vma = find_exact_vma(mm, vm_start, vm_end);
@@ -2219,8 +2198,6 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
 out_no_vma:
        up_read(&mm->mmap_sem);
        mmput(mm);
-out_unlock:
-       unlock_trace(task);
 out_put_task:
        put_task_struct(task);
 out:
@@ -2254,7 +2231,7 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
                goto out;
 
        ret = -EACCES;
-       if (lock_trace(task))
+       if (!ptrace_may_access(task, PTRACE_MODE_READ))
                goto out_put_task;
 
        ret = 0;
@@ -2262,12 +2239,12 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
        case 0:
                ino = inode->i_ino;
                if (filldir(dirent, ".", 1, 0, ino, DT_DIR) < 0)
-                       goto out_unlock;
+                       goto out_put_task;
                filp->f_pos++;
        case 1:
                ino = parent_ino(dentry);
                if (filldir(dirent, "..", 2, 1, ino, DT_DIR) < 0)
-                       goto out_unlock;
+                       goto out_put_task;
                filp->f_pos++;
        default:
        {
@@ -2278,7 +2255,7 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
 
                mm = get_task_mm(task);
                if (!mm)
-                       goto out_unlock;
+                       goto out_put_task;
                down_read(&mm->mmap_sem);
 
                nr_files = 0;
@@ -2308,7 +2285,7 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                        flex_array_free(fa);
                                up_read(&mm->mmap_sem);
                                mmput(mm);
-                               goto out_unlock;
+                               goto out_put_task;
                        }
                        for (i = 0, vma = mm->mmap, pos = 2; vma;
                                        vma = vma->vm_next) {
@@ -2353,8 +2330,6 @@ proc_map_files_readdir(struct file *filp, void *dirent, filldir_t filldir)
        }
        }
 
-out_unlock:
-       unlock_trace(task);
 out_put_task:
        put_task_struct(task);
 out:
@@ -3010,9 +2985,9 @@ static const struct pid_entry tgid_base_stuff[] = {
        INF("cmdline",    S_IRUGO, proc_pid_cmdline),
        ONE("stat",       S_IRUGO, proc_tgid_stat),
        ONE("statm",      S_IRUGO, proc_pid_statm),
-       REG("maps",       S_IRUGO, proc_maps_operations),
+       REG("maps",       S_IRUGO, proc_pid_maps_operations),
 #ifdef CONFIG_NUMA
-       REG("numa_maps",  S_IRUGO, proc_numa_maps_operations),
+       REG("numa_maps",  S_IRUGO, proc_pid_numa_maps_operations),
 #endif
        REG("mem",        S_IRUSR|S_IWUSR, proc_mem_operations),
        LNK("cwd",        proc_cwd_link),
@@ -3023,7 +2998,7 @@ static const struct pid_entry tgid_base_stuff[] = {
        REG("mountstats", S_IRUSR, proc_mountstats_operations),
 #ifdef CONFIG_PROC_PAGE_MONITOR
        REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
-       REG("smaps",      S_IRUGO, proc_smaps_operations),
+       REG("smaps",      S_IRUGO, proc_pid_smaps_operations),
        REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
@@ -3369,9 +3344,9 @@ static const struct pid_entry tid_base_stuff[] = {
        INF("cmdline",   S_IRUGO, proc_pid_cmdline),
        ONE("stat",      S_IRUGO, proc_tid_stat),
        ONE("statm",     S_IRUGO, proc_pid_statm),
-       REG("maps",      S_IRUGO, proc_maps_operations),
+       REG("maps",      S_IRUGO, proc_tid_maps_operations),
 #ifdef CONFIG_NUMA
-       REG("numa_maps", S_IRUGO, proc_numa_maps_operations),
+       REG("numa_maps", S_IRUGO, proc_tid_numa_maps_operations),
 #endif
        REG("mem",       S_IRUSR|S_IWUSR, proc_mem_operations),
        LNK("cwd",       proc_cwd_link),
@@ -3381,7 +3356,7 @@ static const struct pid_entry tid_base_stuff[] = {
        REG("mountinfo",  S_IRUGO, proc_mountinfo_operations),
 #ifdef CONFIG_PROC_PAGE_MONITOR
        REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
-       REG("smaps",     S_IRUGO, proc_smaps_operations),
+       REG("smaps",     S_IRUGO, proc_tid_smaps_operations),
        REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY