Commit 0635a74b authored by John Johansen's avatar John Johansen Committed by Greg Kroah-Hartman

AppArmor: Fix reference to rcu protected pointer outside of rcu_read_lock

commit 04fdc099 upstream.

The pointer returned from tracehook_tracer_task() is only valid inside
the rcu_read_lock.  However the tracer pointer obtained is being passed
to aa_may_ptrace outside of the rcu_read_lock critical section.

Mover the aa_may_ptrace test into the rcu_read_lock critical section, to
fix this.

Kernels affected: 2.6.36 - 3.0
Reported-by: default avatarOleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent e73ff290
...@@ -73,7 +73,6 @@ static int may_change_ptraced_domain(struct task_struct *task, ...@@ -73,7 +73,6 @@ static int may_change_ptraced_domain(struct task_struct *task,
cred = get_task_cred(tracer); cred = get_task_cred(tracer);
tracerp = aa_cred_profile(cred); tracerp = aa_cred_profile(cred);
} }
rcu_read_unlock();
/* not ptraced */ /* not ptraced */
if (!tracer || unconfined(tracerp)) if (!tracer || unconfined(tracerp))
...@@ -82,6 +81,7 @@ static int may_change_ptraced_domain(struct task_struct *task, ...@@ -82,6 +81,7 @@ static int may_change_ptraced_domain(struct task_struct *task,
error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH); error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
out: out:
rcu_read_unlock();
if (cred) if (cred)
put_cred(cred); put_cred(cred);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment