releases/3.0.1/apparmor-fix-reference-to-rcu-protected-pointer-outside-of.patch

   1 From 04fdc099f9c80c7775dbac388fc97e156d4d47e7 Mon Sep 17 00:00:00 2001
   2 From: John Johansen <john.johansen@canonical.com>
   3 Date: Tue, 28 Jun 2011 15:06:38 +0100
   4 Subject: AppArmor: Fix reference to rcu protected pointer outside of
   5  rcu_read_lock
   6
   7 From: John Johansen <john.johansen@canonical.com>
   8
   9 commit 04fdc099f9c80c7775dbac388fc97e156d4d47e7 upstream.
  10
  11 The pointer returned from tracehook_tracer_task() is only valid inside
  12 the rcu_read_lock.  However the tracer pointer obtained is being passed
  13 to aa_may_ptrace outside of the rcu_read_lock critical section.
  14
  15 Mover the aa_may_ptrace test into the rcu_read_lock critical section, to
  16 fix this.
  17
  18 Kernels affected: 2.6.36 - 3.0
  19
  20 Reported-by: Oleg Nesterov <oleg@redhat.com>
  21 Signed-off-by: John Johansen <john.johansen@canonical.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  23
  24 ---
  25  security/apparmor/domain.c |    2 +-
  26  1 file changed, 1 insertion(+), 1 deletion(-)
  27
  28 --- a/security/apparmor/domain.c
  29 +++ b/security/apparmor/domain.c
  30 @@ -73,7 +73,6 @@ static int may_change_ptraced_domain(str
  31                 cred = get_task_cred(tracer);
  32                 tracerp = aa_cred_profile(cred);
  33         }
  34 -       rcu_read_unlock();
  35
  36         /* not ptraced */
  37         if (!tracer || unconfined(tracerp))
  38 @@ -82,6 +81,7 @@ static int may_change_ptraced_domain(str
  39         error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
  40
  41  out:
  42 +       rcu_read_unlock();
  43         if (cred)
  44                 put_cred(cred);
  45