From: Jiri Pirko <jpirko@redhat.com> Date: Thu, 19 Aug 2010 11:28:37 -0400 Subject: [mm] pass correct mm when growing stack Message-id: <1282217317-11853-6-git-send-email-jpirko@redhat.com> Patchwork-id: 27714 O-Subject: [PATCH RHEL5.6 5/5] mm: pass correct mm when growing stack Bugzilla: 607858 CVE: CVE-2010-2240 RH-Acked-by: Rik van Riel <riel@redhat.com> RH-Acked-by: Jarod Wilson <jarod@redhat.com> Tetsuo Handa reports seeing the WARN_ON(current->mm == NULL) in security_vm_enough_memory(), when do_execve() is touching the target mm's stack, to set up its args and environment. Yes, a UMH_NO_WAIT or UMH_WAIT_PROC call_usermodehelper() spawns an mm-less kernel thread to do the exec. And in any case, that vm_enough_memory check when growing stack ought to be done on the target mm, not on the execer's mm (though apart from the warning, it only makes a slight tweak to OVERCOMMIT_NEVER behaviour). Signed-off-by: Jiri Pirko <jpirko@redhat.com> diff --git a/mm/mmap.c b/mm/mmap.c index 84b1a65..4b7dd25 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1623,7 +1623,7 @@ static int acct_stack_growth(struct vm_area_struct * vma, unsigned long size, un * Overcommit.. This must be the final test, as it will * update security statistics. */ - if (security_vm_enough_memory(grow)) + if (security_vm_enough_memory_mm(mm, grow)) return -ENOMEM; /* Ok, everything looks good - let it rip */