Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ab263f47 authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Al Viro
Browse files

audit: Use rcu for task lookup protection 



Protect the task lookups in audit_receive_msg() with rcu_read_lock()
instead of tasklist_lock and use lock/unlock_sighand to protect
against the exit race.

Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 20703205

kernel/audit.c

+14 −16
Original line number Diff line number Diff line
@@ -873,17 +873,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 
	case AUDIT_TTY_GET: {

		struct audit_tty_status s;

		struct task_struct *tsk;

		unsigned long flags;



		read_lock(&tasklist_lock);

		rcu_read_lock();

		tsk = find_task_by_vpid(pid);

		if (!tsk)

			err = -ESRCH;

		else {

			spin_lock_irq(&tsk->sighand->siglock);

		if (tsk && lock_task_sighand(tsk, &flags)) {

			s.enabled = tsk->signal->audit_tty != 0;

			spin_unlock_irq(&tsk->sighand->siglock);

		}

		read_unlock(&tasklist_lock);

			unlock_task_sighand(tsk, &flags);

		} else

			err = -ESRCH;

		rcu_read_unlock();



		if (!err)

			audit_send_reply(NETLINK_CB(skb).pid, seq,
@@ -893,22 +892,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 
	case AUDIT_TTY_SET: {

		struct audit_tty_status *s;

		struct task_struct *tsk;

		unsigned long flags;



		if (nlh->nlmsg_len < sizeof(struct audit_tty_status))

			return -EINVAL;

		s = data;

		if (s->enabled != 0 && s->enabled != 1)

			return -EINVAL;

		read_lock(&tasklist_lock);

		rcu_read_lock();

		tsk = find_task_by_vpid(pid);

		if (!tsk)

			err = -ESRCH;

		else {

			spin_lock_irq(&tsk->sighand->siglock);

		if (tsk && lock_task_sighand(tsk, &flags)) {

			tsk->signal->audit_tty = s->enabled != 0;

			spin_unlock_irq(&tsk->sighand->siglock);

		}

		read_unlock(&tasklist_lock);

			unlock_task_sighand(tsk, &flags);

		} else

			err = -ESRCH;

		rcu_read_unlock();

		break;

	}

	default: