proc: fix oops on invalid /proc/<pid>/maps access, CVE-2011-1020

[linux-flexiantxendom0-natty.git] / fs / proc / task_mmu.c

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 0705534..7f5e572 100644 (file)
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -66,8 +66,9 @@ unsigned long task_vsize(struct mm_struct *mm)
        return PAGE_SIZE * mm->total_vm;
 }
 
-int task_statm(struct mm_struct *mm, int *shared, int *text,
-              int *data, int *resident)
+unsigned long task_statm(struct mm_struct *mm,
+                        unsigned long *shared, unsigned long *text,
+                        unsigned long *data, unsigned long *resident)
 {
        *shared = get_mm_counter(mm, MM_FILEPAGES);
        *text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK))
@@ -118,11 +119,11 @@ static void *m_start(struct seq_file *m, loff_t *pos)
 
        priv->task = get_pid_task(priv->pid, PIDTYPE_PID);
        if (!priv->task)
-               return NULL;
+               return ERR_PTR(-ESRCH);
 
        mm = mm_for_maps(priv->task);
-       if (!mm)
-               return NULL;
+       if (!mm || IS_ERR(mm))
+               return mm;
        down_read(&mm->mmap_sem);
 
        tail_vma = get_gate_vma(priv->task);
@@ -179,7 +180,8 @@ static void m_stop(struct seq_file *m, void *v)
        struct proc_maps_private *priv = m->private;
        struct vm_area_struct *vma = v;
 
-       vma_stop(priv, vma);
+       if (!IS_ERR(vma))
+               vma_stop(priv, vma);
        if (priv->task)
                put_task_struct(priv->task);
 }
@@ -210,6 +212,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
        int flags = vma->vm_flags;
        unsigned long ino = 0;
        unsigned long long pgoff = 0;
+       unsigned long start, end;
        dev_t dev = 0;
        int len;
 
@@ -220,9 +223,17 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
                pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
        }
 
+       /* We don't show the stack guard page in /proc/maps */
+       start = vma->vm_start;
+       if (stack_guard_page_start(vma, start))
+               start += PAGE_SIZE;
+       end = vma->vm_end;
+       if (stack_guard_page_end(vma, end))
+               end -= PAGE_SIZE;
+
        seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-                       vma->vm_start,
-                       vma->vm_end,
+                       start,
+                       end,
                        flags & VM_READ ? 'r' : '-',
                        flags & VM_WRITE ? 'w' : '-',
                        flags & VM_EXEC ? 'x' : '-',
@@ -241,31 +252,12 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
                const char *name = arch_vma_name(vma);
                if (!name) {
                        if (mm) {
-                               if (vma->vm_start <= mm->start_brk &&
-                                               vma->vm_end >= mm->brk) {
+                               if (vma->vm_start <= mm->brk &&
+                                               vma->vm_end >= mm->start_brk) {
                                        name = "[heap]";
                                } else if (vma->vm_start <= mm->start_stack &&
                                           vma->vm_end >= mm->start_stack) {
                                        name = "[stack]";
-                               } else {
-                                       unsigned long stack_start;
-                                       struct proc_maps_private *pmp;
-
-                                       pmp = m->private;
-                                       stack_start = pmp->task->stack_start;
-
-                                       if (vma->vm_start <= stack_start &&
-                                           vma->vm_end >= stack_start) {
-                                               pad_len_spaces(m, len);
-                                               seq_printf(m,
-                                                "[threadstack:%08lx]",
-#ifdef CONFIG_STACK_GROWSUP
-                                                vma->vm_end - stack_start
-#else
-                                                stack_start - vma->vm_start
-#endif
-                                               );
-                                       }
                                }
                        } else {
                                name = "[vdso]";
@@ -339,6 +331,7 @@ struct mem_size_stats {
        unsigned long private_clean;
        unsigned long private_dirty;
        unsigned long referenced;
+       unsigned long anonymous;
        unsigned long swap;
        u64 pss;
 };
@@ -369,19 +362,22 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                if (!page)
                        continue;
 
+               if (PageAnon(page))
+                       mss->anonymous += PAGE_SIZE;
+
                mss->resident += PAGE_SIZE;
                /* Accumulate the size in pages that have been accessed. */
                if (pte_young(ptent) || PageReferenced(page))
                        mss->referenced += PAGE_SIZE;
                mapcount = page_mapcount(page);
                if (mapcount >= 2) {
-                       if (pte_dirty(ptent))
+                       if (pte_dirty(ptent) || PageDirty(page))
                                mss->shared_dirty += PAGE_SIZE;
                        else
                                mss->shared_clean += PAGE_SIZE;
                        mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
                } else {
-                       if (pte_dirty(ptent))
+                       if (pte_dirty(ptent) || PageDirty(page))
                                mss->private_dirty += PAGE_SIZE;
                        else
                                mss->private_clean += PAGE_SIZE;
@@ -422,9 +418,11 @@ static int show_smap(struct seq_file *m, void *v)
                   "Private_Clean:  %8lu kB\n"
                   "Private_Dirty:  %8lu kB\n"
                   "Referenced:     %8lu kB\n"
+                  "Anonymous:      %8lu kB\n"
                   "Swap:           %8lu kB\n"
                   "KernelPageSize: %8lu kB\n"
-                  "MMUPageSize:    %8lu kB\n",
+                  "MMUPageSize:    %8lu kB\n"
+                  "Locked:         %8lu kB\n",
                   (vma->vm_end - vma->vm_start) >> 10,
                   mss.resident >> 10,
                   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
@@ -433,9 +431,12 @@ static int show_smap(struct seq_file *m, void *v)
                   mss.private_clean >> 10,
                   mss.private_dirty >> 10,
                   mss.referenced >> 10,
+                  mss.anonymous >> 10,
                   mss.swap >> 10,
                   vma_kernel_pagesize(vma) >> 10,
-                  vma_mmu_pagesize(vma) >> 10);
+                  vma_mmu_pagesize(vma) >> 10,
+                  (vma->vm_flags & VM_LOCKED) ?
+                       (unsigned long)(mss.pss >> (10 + PSS_SHIFT)) : 0);
 
        if (m->count < m->size)  /* vma is copied successfully */
                m->version = (vma != get_gate_vma(task)) ? vma->vm_start : 0;
@@ -551,6 +552,7 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
 
 const struct file_operations proc_clear_refs_operations = {
        .write          = clear_refs_write,
+       .llseek         = noop_llseek,
 };
 
 struct pagemapread {
@@ -653,6 +655,7 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
        return err;
 }
 
+#ifdef CONFIG_HUGETLB_PAGE
 static u64 huge_pte_to_pagemap_entry(pte_t pte, int offset)
 {
        u64 pme = 0;
@@ -683,6 +686,7 @@ static int pagemap_hugetlb_range(pte_t *pte, unsigned long hmask,
 
        return err;
 }
+#endif /* HUGETLB_PAGE */
 
 /*
  * /proc/pid/pagemap - an array mapping virtual pages to pfns
@@ -709,6 +713,7 @@ static int pagemap_hugetlb_range(pte_t *pte, unsigned long hmask,
  * skip over unmapped regions.
  */
 #define PAGEMAP_WALK_SIZE      (PMD_SIZE)
+#define PAGEMAP_WALK_MASK      (PMD_MASK)
 static ssize_t pagemap_read(struct file *file, char __user *buf,
                            size_t count, loff_t *ppos)
 {
@@ -726,8 +731,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
        if (!task)
                goto out;
 
-       ret = -EACCES;
-       if (!ptrace_may_access(task, PTRACE_MODE_READ))
+       mm = mm_for_maps(task);
+       ret = PTR_ERR(mm);
+       if (!mm || IS_ERR(mm))
                goto out_task;
 
        ret = -EINVAL;
@@ -740,10 +746,6 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
        if (!count)
                goto out_task;
 
-       mm = get_task_mm(task);
-       if (!mm)
-               goto out_task;
-
        pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
        pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
        ret = -ENOMEM;
@@ -752,7 +754,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 
        pagemap_walk.pmd_entry = pagemap_pte_range;
        pagemap_walk.pte_hole = pagemap_pte_hole;
+#ifdef CONFIG_HUGETLB_PAGE
        pagemap_walk.hugetlb_entry = pagemap_hugetlb_range;
+#endif
        pagemap_walk.mm = mm;
        pagemap_walk.private = &pm;
 
@@ -777,7 +781,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                unsigned long end;
 
                pm.pos = 0;
-               end = start_vaddr + PAGEMAP_WALK_SIZE;
+               end = (start_vaddr + PAGEMAP_WALK_SIZE) & PAGEMAP_WALK_MASK;
                /* overflow ? */
                if (end < start_vaddr || end > end_vaddr)
                        end = end_vaddr;