1 files changed, 39 insertions, 106 deletions

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 22511548d90..a70150ae505 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -195,65 +195,7 @@ static int proc_root_link(struct inode *inode, struct path *path)
         return result;
 }
 
-static struct mm_struct *__check_mem_permission(struct task_struct *task)
-{
-        struct mm_struct *mm;
-
-        mm = get_task_mm(task);
-        if (!mm)
-                return ERR_PTR(-EINVAL);
-
-        /*
-         * A task can always look at itself, in case it chooses
-         * to use system calls instead of load instructions.
-         */
-        if (task == current)
-                return mm;
-
-        /*
-         * If current is actively ptrace'ing, and would also be
-         * permitted to freshly attach with ptrace now, permit it.
-         */
-        if (task_is_stopped_or_traced(task)) {
-                int match;
-                rcu_read_lock();
-                match = (tracehook_tracer_task(task) == current);
-                rcu_read_unlock();
-                if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
-                        return mm;
-        }
-
-        /*
-         * No one else is allowed.
-         */
-        mmput(mm);
-        return ERR_PTR(-EPERM);
-}
-
-/*
- * If current may access user memory in @task return a reference to the
- * corresponding mm, otherwise ERR_PTR.
- */
-static struct mm_struct *check_mem_permission(struct task_struct *task)
-{
-        struct mm_struct *mm;
-        int err;
-
-        /*
-         * Avoid racing if task exec's as we might get a new mm but validate
-         * against old credentials.
-         */
-        err = mutex_lock_killable(&task->signal->cred_guard_mutex);
-        if (err)
-                return ERR_PTR(err);
-
-        mm = __check_mem_permission(task);
-        mutex_unlock(&task->signal->cred_guard_mutex);
-
-        return mm;
-}
-
-struct mm_struct *mm_for_maps(struct task_struct *task)
+static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
 {
         struct mm_struct *mm;
         int err;
@@ -264,7 +206,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
 
         mm = get_task_mm(task);
         if (mm && mm != current->mm &&
-                        !ptrace_may_access(task, PTRACE_MODE_READ)) {
+                        !ptrace_may_access(task, mode)) {
                 mmput(mm);
                 mm = ERR_PTR(-EACCES);
         }
@@ -273,6 +215,11 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
         return mm;
 }
 
+struct mm_struct *mm_for_maps(struct task_struct *task)
+{
+        return mm_access(task, PTRACE_MODE_READ);
+}
+
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
 {
         int res = 0;
@@ -841,38 +788,39 @@ static const struct file_operations proc_single_file_operations = {
 
 static int mem_open(struct inode* inode, struct file* file)
 {
-        file->private_data = (void*)((long)current->self_exec_id);
+        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+        struct mm_struct *mm;
+
+        if (!task)
+                return -ESRCH;
+
+        mm = mm_access(task, PTRACE_MODE_ATTACH);
+        put_task_struct(task);
+
+        if (IS_ERR(mm))
+                return PTR_ERR(mm);
+
         /* OK to pass negative loff_t, we can catch out-of-range */
         file->f_mode |= FMODE_UNSIGNED_OFFSET;
+        file->private_data = mm;
+
         return 0;
 }
 
 static ssize_t mem_read(struct file * file, char __user * buf,
                         size_t count, loff_t *ppos)
 {
-        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+        int ret;
         char *page;
         unsigned long src = *ppos;
-        int ret = -ESRCH;
-        struct mm_struct *mm;
+        struct mm_struct *mm = file->private_data;
 
-        if (!task)
-                goto out_no_task;
+        if (!mm)
+                return 0;
 
-        ret = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
-                goto out;
-
-        mm = check_mem_permission(task);
-        ret = PTR_ERR(mm);
-        if (IS_ERR(mm))
-                goto out_free;
-
-        ret = -EIO;
- 
-        if (file->private_data != (void*)((long)current->self_exec_id))
-                goto out_put;
+                return -ENOMEM;
 
         ret = 0;
  
@@ -899,13 +847,7 @@ static ssize_t mem_read(struct file * file, char __user * buf,
         }
         *ppos = src;
 
-out_put:
-        mmput(mm);
-out_free:
         free_page((unsigned long) page);
-out:
-        put_task_struct(task);
-out_no_task:
         return ret;
 }
 
@@ -914,27 +856,15 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
 {
         int copied;
         char *page;
-        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
         unsigned long dst = *ppos;
-        struct mm_struct *mm;
+        struct mm_struct *mm = file->private_data;
 
-        copied = -ESRCH;
-        if (!task)
-                goto out_no_task;
+        if (!mm)
+                return 0;
 
-        copied = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
-                goto out_task;
-
-        mm = check_mem_permission(task);
-        copied = PTR_ERR(mm);
-        if (IS_ERR(mm))
-                goto out_free;
-
-        copied = -EIO;
-        if (file->private_data != (void *)((long)current->self_exec_id))
-                goto out_mm;
+                return -ENOMEM;
 
         copied = 0;
         while (count > 0) {
@@ -958,13 +888,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
         }
         *ppos = dst;
 
-out_mm:
-        mmput(mm);
-out_free:
         free_page((unsigned long) page);
-out_task:
-        put_task_struct(task);
-out_no_task:
         return copied;
 }
 
@@ -984,11 +908,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
         return file->f_pos;
 }
 
+static int mem_release(struct inode *inode, struct file *file)
+{
+        struct mm_struct *mm = file->private_data;
+
+        mmput(mm);
+        return 0;
+}
+
 static const struct file_operations proc_mem_operations = {
         .llseek         = mem_lseek,
         .read           = mem_read,
         .write          = mem_write,
         .open           = mem_open,
+        .release        = mem_release,
 };
 
 static ssize_t environ_read(struct file *file, char __user *buf,