lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[PATCH] NOMMU: Check that access_process_vm() has a valid target

Browse Source 
Check that access_process_vm() is accessing a valid mapping in the target
process.

This limits ptrace() accesses and accesses through /proc/<pid>/maps to only
those regions actually mapped by a program.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
David Howells
2006-09-27 01:50:15 -07:00
committed by Linus Torvalds
parent 361f6ed1d0
commit 0ec76a110f
3 changed files with 100 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
mm/nommu.c
View File

@ -1206,3 +1206,50 @@ struct page *filemap_nopage(struct vm_area_struct *area,
BUG();
return NULL;
}
/*
* Access another process' address space.
* - source/target buffer must be kernel space
*/
int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write)
{
struct vm_list_struct *vml;
struct vm_area_struct *vma;
struct mm_struct *mm;
if (addr + len < addr)
return 0;
mm = get_task_mm(tsk);
if (!mm)
return 0;
down_read(&mm->mmap_sem);
/* the access must start within one of the target process's mappings */
for (vml = mm->context.vmlist; vml; vml = vml->next)
if (addr >= vml->vma->vm_start && addr < vml->vma->vm_end)
break;
if (vml) {
vma = vml->vma;
/* don't overrun this mapping */
if (addr + len >= vma->vm_end)
len = vma->vm_end - addr;
/* only read or write mappings where it is permitted */
if (write && vma->vm_flags & VM_WRITE)
len -= copy_to_user((void *) addr, buf, len);
else if (!write && vma->vm_flags & VM_READ)
len -= copy_from_user(buf, (void *) addr, len);
else
len = 0;
} else {
len = 0;
}
up_read(&mm->mmap_sem);
mmput(mm);
return len;
}