close race in /proc/*/environ
Switch to mm_for_maps(). Maybe we ought to make it r--r--r--, since we do checks on IO anyway... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
@@ -919,20 +919,18 @@ static ssize_t environ_read(struct file *file, char __user *buf,
|
|||||||
if (!task)
|
if (!task)
|
||||||
goto out_no_task;
|
goto out_no_task;
|
||||||
|
|
||||||
if (!ptrace_may_access(task, PTRACE_MODE_READ))
|
|
||||||
goto out;
|
|
||||||
|
|
||||||
ret = -ENOMEM;
|
ret = -ENOMEM;
|
||||||
page = (char *)__get_free_page(GFP_TEMPORARY);
|
page = (char *)__get_free_page(GFP_TEMPORARY);
|
||||||
if (!page)
|
if (!page)
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
ret = 0;
|
|
||||||
|
|
||||||
mm = get_task_mm(task);
|
mm = mm_for_maps(task);
|
||||||
if (!mm)
|
ret = PTR_ERR(mm);
|
||||||
|
if (!mm || IS_ERR(mm))
|
||||||
goto out_free;
|
goto out_free;
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
while (count > 0) {
|
while (count > 0) {
|
||||||
int this_len, retval, max_len;
|
int this_len, retval, max_len;
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user