pagemap: close races with suid execve

just use mm_for_maps()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

2 files changed, 4 insertions, 7 deletions

diff --git a/fs/proc/base.c b/fs/proc/base.c
index b77236de6d8f..df73573e12c9 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2797,7 +2797,7 @@ static const struct pid_entry tgid_base_stuff[] = {
 #ifdef CONFIG_PROC_PAGE_MONITOR
         REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
         REG("smaps",      S_IRUGO, proc_smaps_operations),
-        REG("pagemap",    S_IRUSR, proc_pagemap_operations),
+        REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
         DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
@@ -3133,7 +3133,7 @@ static const struct pid_entry tid_base_stuff[] = {
 #ifdef CONFIG_PROC_PAGE_MONITOR
         REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
         REG("smaps",     S_IRUGO, proc_smaps_operations),
-        REG("pagemap",    S_IRUSR, proc_pagemap_operations),
+        REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
         DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 60b914860f81..c966413c139b 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -729,7 +729,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                 goto out;
 
         ret = -EACCES;
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
+        mm = mm_for_maps(task);
+        if (!mm)
                 goto out_task;
 
         ret = -EINVAL;
@@ -742,10 +743,6 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         if (!count)
                 goto out_task;
 
-        mm = get_task_mm(task);
-        if (!mm)
-                goto out_task;
-
         pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
         pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
         ret = -ENOMEM;