sys_ioprio_get() accesses __task_cred() without being in a RCU read
side critical section. tasklist_lock is not protecting that when
CONFIG_TREE_PREEMPT_RCU=y.
Add a rcu_read_lock/unlock() section around the code which accesses
__task_cred().
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Cc: David Howells <dhowells@xxxxxxxxxx>
Cc: James Morris <jmorris@xxxxxxxxx>
Cc: linux-security-module@xxxxxxxxxxxxxxx
Cc: linux-fsdevel@xxxxxxxxxxxxxxx
Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
---
fs/ioprio.c | 2 ++
1 file changed, 2 insertions(+)
Index: linux-2.6-tip/fs/ioprio.c
===================================================================
--- linux-2.6-tip.orig/fs/ioprio.c
+++ linux-2.6-tip/fs/ioprio.c
@@ -230,6 +230,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
if (!user)
break;
+ rcu_read_lock();
do_each_thread(g, p) {
if (__task_cred(p)->uid != user->uid)
continue;
@@ -241,6 +242,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
else
ret = ioprio_best(ret, tmpio);
} while_each_thread(g, p);
+ rcu_read_unlock();
if (who)
free_uid(user);
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
