aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux
diff options
context:
space:
mode:
authorAlan Cox <alan@lxorguk.ukuu.org.uk>2007-08-22 17:01:28 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-08-22 22:52:45 -0400
commit34b4e4aa3c470ce8fa2bd78abb1741b4b58baad7 (patch)
tree91d620288f1aaf63c12dc84ca1015465818601f2 /include/linux
parentafe1ab4d577892822de2c8e803fbfaed6ec44ba3 (diff)
fix NULL pointer dereference in __vm_enough_memory()
The new exec code inserts an accounted vma into an mm struct which is not current->mm. The existing memory check code has a hard coded assumption that this does not happen as does the security code. As the correct mm is known we pass the mm to the security method and the helper function. A new security test is added for the case where we need to pass the mm and the existing one is modified to pass current->mm to avoid the need to change large amounts of code. (Thanks to Tobias for fixing rejects and testing) Signed-off-by: Alan Cox <alan@redhat.com> Cc: WU Fengguang <wfg@mail.ustc.edu.cn> Cc: James Morris <jmorris@redhat.com> Cc: Tobias Diedrich <ranma+kernel@tdiedrich.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux')
-rw-r--r--include/linux/mm.h2
-rw-r--r--include/linux/security.h20
2 files changed, 16 insertions, 6 deletions
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 655094dc9440..1692dd6cb915 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1042,7 +1042,7 @@ static inline void vma_nonlinear_insert(struct vm_area_struct *vma,
1042} 1042}
1043 1043
1044/* mmap.c */ 1044/* mmap.c */
1045extern int __vm_enough_memory(long pages, int cap_sys_admin); 1045extern int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin);
1046extern void vma_adjust(struct vm_area_struct *vma, unsigned long start, 1046extern void vma_adjust(struct vm_area_struct *vma, unsigned long start,
1047 unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert); 1047 unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert);
1048extern struct vm_area_struct *vma_merge(struct mm_struct *, 1048extern struct vm_area_struct *vma_merge(struct mm_struct *,
diff --git a/include/linux/security.h b/include/linux/security.h
index c11dc8aa0351..1a15526e9f67 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -54,7 +54,7 @@ extern int cap_inode_removexattr(struct dentry *dentry, char *name);
54extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags); 54extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
55extern void cap_task_reparent_to_init (struct task_struct *p); 55extern void cap_task_reparent_to_init (struct task_struct *p);
56extern int cap_syslog (int type); 56extern int cap_syslog (int type);
57extern int cap_vm_enough_memory (long pages); 57extern int cap_vm_enough_memory (struct mm_struct *mm, long pages);
58 58
59struct msghdr; 59struct msghdr;
60struct sk_buff; 60struct sk_buff;
@@ -1125,6 +1125,7 @@ struct request_sock;
1125 * Return 0 if permission is granted. 1125 * Return 0 if permission is granted.
1126 * @vm_enough_memory: 1126 * @vm_enough_memory:
1127 * Check permissions for allocating a new virtual mapping. 1127 * Check permissions for allocating a new virtual mapping.
1128 * @mm contains the mm struct it is being added to.
1128 * @pages contains the number of pages. 1129 * @pages contains the number of pages.
1129 * Return 0 if permission is granted. 1130 * Return 0 if permission is granted.
1130 * 1131 *
@@ -1169,7 +1170,7 @@ struct security_operations {
1169 int (*quota_on) (struct dentry * dentry); 1170 int (*quota_on) (struct dentry * dentry);
1170 int (*syslog) (int type); 1171 int (*syslog) (int type);
1171 int (*settime) (struct timespec *ts, struct timezone *tz); 1172 int (*settime) (struct timespec *ts, struct timezone *tz);
1172 int (*vm_enough_memory) (long pages); 1173 int (*vm_enough_memory) (struct mm_struct *mm, long pages);
1173 1174
1174 int (*bprm_alloc_security) (struct linux_binprm * bprm); 1175 int (*bprm_alloc_security) (struct linux_binprm * bprm);
1175 void (*bprm_free_security) (struct linux_binprm * bprm); 1176 void (*bprm_free_security) (struct linux_binprm * bprm);
@@ -1469,10 +1470,14 @@ static inline int security_settime(struct timespec *ts, struct timezone *tz)
1469 return security_ops->settime(ts, tz); 1470 return security_ops->settime(ts, tz);
1470} 1471}
1471 1472
1472
1473static inline int security_vm_enough_memory(long pages) 1473static inline int security_vm_enough_memory(long pages)
1474{ 1474{
1475 return security_ops->vm_enough_memory(pages); 1475 return security_ops->vm_enough_memory(current->mm, pages);
1476}
1477
1478static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
1479{
1480 return security_ops->vm_enough_memory(mm, pages);
1476} 1481}
1477 1482
1478static inline int security_bprm_alloc (struct linux_binprm *bprm) 1483static inline int security_bprm_alloc (struct linux_binprm *bprm)
@@ -2219,7 +2224,12 @@ static inline int security_settime(struct timespec *ts, struct timezone *tz)
2219 2224
2220static inline int security_vm_enough_memory(long pages) 2225static inline int security_vm_enough_memory(long pages)
2221{ 2226{
2222 return cap_vm_enough_memory(pages); 2227 return cap_vm_enough_memory(current->mm, pages);
2228}
2229
2230static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
2231{
2232 return cap_vm_enough_memory(mm, pages);
2223} 2233}
2224 2234
2225static inline int security_bprm_alloc (struct linux_binprm *bprm) 2235static inline int security_bprm_alloc (struct linux_binprm *bprm)