Re: [PATCH RESEND] Fix race in process_vm_rw_core

[Oleg Nesterov <oleg@redhat.com>]

On 01/30, Christopher Yeoh wrote:
>
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -198,7 +198,7 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
>  	return result;
>  }
>
> -static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
> +struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)

This is not enough, we should move it outside of fs/proc/, otherwise
the kernel can't be compiled without CONFIG_PROC.

> --- a/mm/process_vm_access.c
> +++ b/mm/process_vm_access.c
> @@ -298,23 +298,15 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
>  		goto free_proc_pages;
>  	}
>  
> -	task_lock(task);
> -	if (__ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
> -		task_unlock(task);
> -		rc = -EPERM;
> -		goto put_task_struct;
> -	}
> -	mm = task->mm;
> -
> -	if (!mm || (task->flags & PF_KTHREAD)) {
> -		task_unlock(task);
> -		rc = -EINVAL;
> +	mm = mm_access(task, PTRACE_MODE_ATTACH);
> +	if (!mm || IS_ERR(mm)) {
> +		if (!mm)
> +			rc = -EINVAL;
> +		else
> +			rc = -EPERM;
>  		goto put_task_struct;
>  	}
>  
> -	atomic_inc(&mm->mm_users);
> -	task_unlock(task);
> -

Looks obviously correct.

Oleg.