[PATCH v3 4/5] liveupdate: fix TOCTOU race in luo_session_retrieve()

[Pasha Tatashin]

Extend the scope of the rwsem_read lock in luo_session_retrieve() to
overlap with the acquisition of the session mutex. This prevents a
concurrent thread from releasing and freeing the session between the
lookup and the mutex lock.

Fixes: 0153094d03df ("liveupdate: luo_session: add sessions support")
Signed-off-by: Pasha Tatashin <pasha.tatas...@soleen.com>
---
 kernel/liveupdate/luo_session.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 5aa0011d9643..f99a82517e51 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -426,12 +426,11 @@ int luo_session_retrieve(const char *name, struct file 
**filep)
        int err;
 
        guard(rwsem_read)(&luo_session_serialize_rwsem);
-       scoped_guard(rwsem_read, &sh->rwsem) {
-               list_for_each_entry(it, &sh->list, list) {
-                       if (!strncmp(it->name, name, sizeof(it->name))) {
-                               session = it;
-                               break;
-                       }
+       guard(rwsem_read)(&sh->rwsem);
+       list_for_each_entry(it, &sh->list, list) {
+               if (!strncmp(it->name, name, sizeof(it->name))) {
+                       session = it;
+                       break;
                }
        }
 
-- 
2.53.0