From: Jiri Pirko <jpirko@redhat.com>
Date: Thu, 19 Aug 2010 11:28:37 -0400
Subject: [mm] pass correct mm when growing stack
Message-id: <1282217317-11853-6-git-send-email-jpirko@redhat.com>
Patchwork-id: 27714
O-Subject: [PATCH RHEL5.6 5/5] mm: pass correct mm when growing stack
Bugzilla: 607858
CVE: CVE-2010-2240
RH-Acked-by: Rik van Riel <riel@redhat.com>
RH-Acked-by: Jarod Wilson <jarod@redhat.com>

Tetsuo Handa reports seeing the WARN_ON(current->mm == NULL) in
    security_vm_enough_memory(), when do_execve() is touching the
    target mm's stack, to set up its args and environment.

    Yes, a UMH_NO_WAIT or UMH_WAIT_PROC call_usermodehelper() spawns
    an mm-less kernel thread to do the exec.  And in any case, that
    vm_enough_memory check when growing stack ought to be done on the
    target mm, not on the execer's mm (though apart from the warning,
    it only makes a slight tweak to OVERCOMMIT_NEVER behaviour).

Signed-off-by: Jiri Pirko <jpirko@redhat.com>

diff --git a/mm/mmap.c b/mm/mmap.c
index 84b1a65..4b7dd25 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1623,7 +1623,7 @@ static int acct_stack_growth(struct vm_area_struct * vma, unsigned long size, un
 	 * Overcommit..  This must be the final test, as it will
 	 * update security statistics.
 	 */
-	if (security_vm_enough_memory(grow))
+	if (security_vm_enough_memory_mm(mm, grow))
 		return -ENOMEM;
 
 	/* Ok, everything looks good - let it rip */