Vasiliy Kulikov 293eb1e777 proc: fix a race in do_io_accounting() ... If an inode's mode permits opening /proc/PID/io and the resulting file descriptor is kept across execve() of a setuid or similar binary, the ptrace_may_access() check tries to prevent using this fd against the task with escalated privileges. Unfortunately, there is a race in the check against execve(). If execve() is processed after the ptrace check, but before the actual io information gathering, io statistics will be gathered from the privileged process. At least in theory this might lead to gathering sensible information (like ssh/ftp password length) that wouldn't be available otherwise. Holding task->signal->cred_guard_mutex while gathering the io information should protect against the race. The order of locking is similar to the one inside of ptrace_attach(): first goes cred_guard_mutex, then lock_task_sighand(). Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2011-07-26 16:49:43 -07:00
..
array.c	ptrace: s/tracehook_tracer_task()/ptrace_parent()/	2011-06-22 19:26:29 +02:00
base.c	proc: fix a race in do_io_accounting()	2011-07-26 16:49:43 -07:00
cmdline.c
consoles.c
cpuinfo.c
devices.c
generic.c
inode.c	procfs: return ENOENT on opening a being-removed proc entry	2011-07-26 16:49:43 -07:00
internal.h
interrupts.c
Kconfig
kcore.c
kmsg.c
loadavg.c
Makefile
meminfo.c
mmu.c
namespaces.c	proc: Fix Oops on stat of /proc/<zombie pid>/ns/net	2011-06-15 14:35:29 -07:00
nommu.c
page.c
proc_devtree.c
proc_net.c
proc_sysctl.c	->permission() sanitizing: don't pass flags to ->permission()	2011-07-20 01:43:24 -04:00
proc_tty.c
root.c	fix leak in proc_set_super()	2011-06-12 17:45:28 -04:00
softirqs.c
stat.c	proc/stat: use defined macro KMALLOC_MAX_SIZE	2011-05-26 17:12:37 -07:00
task_mmu.c	proc: fix pagemap_read() error case	2011-05-26 17:12:37 -07:00
task_nommu.c
uptime.c
version.c
vmcore.c	fs/proc/vmcore.c: add hook to read_from_oldmem() to check for non-ram pages	2011-05-26 17:12:37 -07:00