add-mmap_assert_locked-annotations-to-find_vma-fix

TOMOYO needs the same protection which get_arg_page() needs.

Link: https://lkml.kernel.org/r/58bb6bf7-a57e-8a40-e74b-39584b415152@i-love.sakura.ne.jp
Cc: Luigi Rizzo <lrizzo@google.com>
Cc: Kentaro Takeda <takedakn@nttdata.co.jp>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

diff --git a/security/tomoyo/domain.c b/security/tomoyo/domain.c
index 98d985895ec8a05fd8cd3fd6590909d1b4924e3b..31af29f669d24068875917f5adfad8948143594e 100644 (file)
--- a/security/tomoyo/domain.c
+++ b/security/tomoyo/domain.c
@@ -897,6 +897,9 @@ bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
                      struct tomoyo_page_dump *dump)
 {
        struct page *page;
+#ifdef CONFIG_MMU
+       int ret;
+#endif
 
        /* dump->data is released by tomoyo_find_next_domain(). */
        if (!dump->data) {
@@ -909,11 +912,13 @@ bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
        /*
         * This is called at execve() time in order to dig around
         * in the argv/environment of the new proceess
-        * (represented by bprm).  'current' is the process doing
-        * the execve().
+        * (represented by bprm).
         */
-       if (get_user_pages_remote(bprm->mm, pos, 1,
-                               FOLL_FORCE, &page, NULL, NULL) <= 0)
+       mmap_read_lock(bprm->mm);
+       ret = get_user_pages_remote(bprm->mm, pos, 1,
+                                   FOLL_FORCE, &page, NULL, NULL);
+       mmap_read_unlock(bprm->mm);
+       if (ret <= 0)
                return false;
 #else
        page = bprm->page[pos / PAGE_SIZE];