[PATCH] proc_pid_cmdline() race fix (CAN-2004-1058)

The following patch fixes a race condition that allows local users to
view the environment variables of another process.

Taken from kernel-2.4.21-27.0.4.EL.src.rpm.

See:
http://linux.bkbits.net:8080/linux-2.6/cset@412a4baaEebwtKg-X7sS2r5Mua6uGw
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133113
http://lkml.org/lkml/2004/7/29/332

Signed-off-by: dann frazier <dannf@debian.org>

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 95fba3f..d8796bf 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -185,8 +185,12 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
        int res = 0;
        task_lock(task);
        mm = task->mm;
-       if (mm)
-               atomic_inc(&mm->mm_users);
+       if (mm) {
+               if (mm->arg_end)
+                       atomic_inc(&mm->mm_users);
+               else
+                       mm = NULL;
+       }
        task_unlock(task);
        if (mm && mm->arg_start && mm->arg_start < mm->arg_end) {
                unsigned long len = mm->arg_end - mm->arg_start;