Merge "smack: fix possible use after frees in task_security() callers" (395511c9) · Commits · e / devices / android_kernel_xiaomi_markw

fs/ecryptfs/crypto.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -2031,7 +2031,6 @@ ecryptfs_decode_from_filename(unsigned char dst, size_t dst_size,
		break;
		case 2:
		dst[dst_byte_offset++] \|= (src_byte);
		dst[dst_byte_offset] = 0;
		current_bit_offset = 0;
		break;
		}

security/smack/smack.h

+10 −0

Original line number	Diff line number	Diff line
		@@ -298,6 +298,16 @@ static inline struct smack_known smk_of_task(const struct task_smack tsp)
		return tsp->smk_task;
		}

		static inline struct smack_known smk_of_task_struct(const struct task_struct t)
		{
		struct smack_known *skp;

		rcu_read_lock();
		skp = smk_of_task(__task_cred(t)->security);
		rcu_read_unlock();
		return skp;
		}

		/*
		* Present a pointer to the forked smack label entry in an task blob.
		*/

security/smack/smack_lsm.c

+13 −11

Original line number	Diff line number	Diff line
		@@ -43,8 +43,6 @@
		#include <linux/binfmts.h>
		#include "smack.h"

		#define task_security(task) (task_cred_xxx((task), security))

		#define TRANS_TRUE "TRUE"
		#define TRANS_TRUE_SIZE 4

		@@ -119,7 +117,7 @@ static int smk_bu_current(char note, struct smack_known oskp,
		static int smk_bu_task(struct task_struct *otp, int mode, int rc)
		{
		struct task_smack *tsp = current_security();
		struct task_smack *otsp = task_security(otp);
		struct smack_known *smk_task = smk_of_task_struct(otp);
		char acc[SMK_NUM_ACCESS_TYPE + 1];

		if (rc <= 0)
		@@ -127,7 +125,7 @@ static int smk_bu_task(struct task_struct *otp, int mode, int rc)

		smk_bu_mode(mode, acc);
		pr_info("Smack Bringup: (%s %s %s) %s to %s\n",
		tsp->smk_task->smk_known, otsp->smk_task->smk_known, acc,
		tsp->smk_task->smk_known, smk_task->smk_known, acc,
		current->comm, otp->comm);
		return 0;
		}
		@@ -344,7 +342,8 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
		saip = &ad;
		}

		tsp = task_security(tracer);
		rcu_read_lock();
		tsp = __task_cred(tracer)->security;
		tracer_known = smk_of_task(tsp);

		if ((mode & PTRACE_MODE_ATTACH) &&
		@@ -364,11 +363,14 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
		tracee_known->smk_known,
		0, rc, saip);

		rcu_read_unlock();
		return rc;
		}

		/* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
		rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);

		rcu_read_unlock();
		return rc;
		}

		@@ -395,7 +397,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
		if (rc != 0)
		return rc;

		skp = smk_of_task(task_security(ctp));
		skp = smk_of_task_struct(ctp);

		rc = smk_ptrace_rule_check(current, skp, mode, __func__);
		return rc;
		@@ -1825,7 +1827,7 @@ static int smk_curacc_on_task(struct task_struct *p, int access,
		const char *caller)
		{
		struct smk_audit_info ad;
		struct smack_known *skp = smk_of_task(task_security(p));
		struct smack_known *skp = smk_of_task_struct(p);
		int rc;

		smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
		@@ -1878,7 +1880,7 @@ static int smack_task_getsid(struct task_struct *p)
		*/
		static void smack_task_getsecid(struct task_struct p, u32 secid)
		{
		struct smack_known *skp = smk_of_task(task_security(p));
		struct smack_known *skp = smk_of_task_struct(p);

		*secid = skp->smk_secid;
		}
		@@ -1985,7 +1987,7 @@ static int smack_task_kill(struct task_struct p, struct siginfo info,
		{
		struct smk_audit_info ad;
		struct smack_known *skp;
		struct smack_known *tkp = smk_of_task(task_security(p));
		struct smack_known *tkp = smk_of_task_struct(p);
		int rc;

		smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
		@@ -2039,7 +2041,7 @@ static int smack_task_wait(struct task_struct *p)
		static void smack_task_to_inode(struct task_struct p, struct inode inode)
		{
		struct inode_smack *isp = inode->i_security;
		struct smack_known *skp = smk_of_task(task_security(p));
		struct smack_known *skp = smk_of_task_struct(p);

		isp->smk_inode = skp;
		}
		@@ -3199,7 +3201,7 @@ unlockandout:
		*/
		static int smack_getprocattr(struct task_struct p, char name, char **value)
		{
		struct smack_known *skp = smk_of_task(task_security(p));
		struct smack_known *skp = smk_of_task_struct(p);
		char *cp;
		int slen;