samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AppArmor: Fix reference to rcu protected pointer outside of rcu_read_lock

Browse Source 
The pointer returned from tracehook_tracer_task() is only valid inside
the rcu_read_lock.  However the tracer pointer obtained is being passed
to aa_may_ptrace outside of the rcu_read_lock critical section.

Mover the aa_may_ptrace test into the rcu_read_lock critical section, to
fix this.

Kernels affected: 2.6.36 - 3.0

Reported-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@kernel.org
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2011-06-28 15:06:38 +01:00
parent b0af8dfdd6
commit 04fdc099f9
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
security/apparmor/domain.c
View File

@@ -73,7 +73,6 @@ static int may_change_ptraced_domain(struct task_struct *task,
cred = get_task_cred(tracer); cred = get_task_cred(tracer);
tracerp = aa_cred_profile(cred); tracerp = aa_cred_profile(cred);
} }
rcu_read_unlock();
/* not ptraced */ /* not ptraced */
if (!tracer || unconfined(tracerp)) if (!tracer || unconfined(tracerp))
@@ -82,6 +81,7 @@ static int may_change_ptraced_domain(struct task_struct *task,
error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH); error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
out: out:
rcu_read_unlock();
if (cred) if (cred)
put_cred(cred); put_cred(cred);