Commit 04fdc099 authored Jun 28, 2011 by John Johansen

AppArmor: Fix reference to rcu protected pointer outside of rcu_read_lock



The pointer returned from tracehook_tracer_task() is only valid inside
the rcu_read_lock.  However the tracer pointer obtained is being passed
to aa_may_ptrace outside of the rcu_read_lock critical section.

Mover the aa_may_ptrace test into the rcu_read_lock critical section, to
fix this.

Kernels affected: 2.6.36 - 3.0

Reported-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@kernel.org
Signed-off-by: John Johansen <john.johansen@canonical.com>

parent b0af8dfd

security/apparmor/domain.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -73,7 +73,6 @@ static int may_change_ptraced_domain(struct task_struct *task,
		cred = get_task_cred(tracer);
		tracerp = aa_cred_profile(cred);
		}
		rcu_read_unlock();

		/* not ptraced */
		if (!tracer \|\| unconfined(tracerp))
		@@ -82,6 +81,7 @@ static int may_change_ptraced_domain(struct task_struct *task,
		error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);

		out:
		rcu_read_unlock();
		if (cred)
		put_cred(cred);

Admin message