Signed-off-by: Ryan Lee <[email protected]>
---
security/apparmor/lsm.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 3168063e8eda..aafd91692aef 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -827,6 +827,13 @@ static int apparmor_getprocattr(struct task_struct *task,
const char *name,
int error = -ENOENT;
struct aa_label *label = NULL;
+ /* Because __task_cred and task_ctx pointers are RCU protected,
+ * we need to obtain a refcount to them under the RCU read lock
+ * to prevent them from being cleaned up as an RCU callback.
+ * Thus, we cannot use the condref versions without moving
+ * aa_getprocattr into the RCU critical section and reworking it
+ * to avoid e.g. GFP_KERNEL allocations.
+ */
rcu_read_lock();
if (strcmp(name, "current") == 0)
label = aa_get_newest_cred_label(__task_cred(task));
--
2.43.0
