提交 ab263f47 编写于 作者: T Thomas Gleixner 提交者: Al Viro

audit: Use rcu for task lookup protection

Protect the task lookups in audit_receive_msg() with rcu_read_lock()
instead of tasklist_lock and use lock/unlock_sighand to protect
against the exit race.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
上级 20703205
......@@ -873,17 +873,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
case AUDIT_TTY_GET: {
struct audit_tty_status s;
struct task_struct *tsk;
unsigned long flags;
read_lock(&tasklist_lock);
rcu_read_lock();
tsk = find_task_by_vpid(pid);
if (!tsk)
err = -ESRCH;
else {
spin_lock_irq(&tsk->sighand->siglock);
if (tsk && lock_task_sighand(tsk, &flags)) {
s.enabled = tsk->signal->audit_tty != 0;
spin_unlock_irq(&tsk->sighand->siglock);
}
read_unlock(&tasklist_lock);
unlock_task_sighand(tsk, &flags);
} else
err = -ESRCH;
rcu_read_unlock();
if (!err)
audit_send_reply(NETLINK_CB(skb).pid, seq,
......@@ -893,22 +892,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
case AUDIT_TTY_SET: {
struct audit_tty_status *s;
struct task_struct *tsk;
unsigned long flags;
if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
return -EINVAL;
s = data;
if (s->enabled != 0 && s->enabled != 1)
return -EINVAL;
read_lock(&tasklist_lock);
rcu_read_lock();
tsk = find_task_by_vpid(pid);
if (!tsk)
err = -ESRCH;
else {
spin_lock_irq(&tsk->sighand->siglock);
if (tsk && lock_task_sighand(tsk, &flags)) {
tsk->signal->audit_tty = s->enabled != 0;
spin_unlock_irq(&tsk->sighand->siglock);
}
read_unlock(&tasklist_lock);
unlock_task_sighand(tsk, &flags);
} else
err = -ESRCH;
rcu_read_unlock();
break;
}
default:
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册