/* * AppArmor security module * * This file contains AppArmor functions used to manipulate object security * contexts. * * Copyright (C) 1998-2008 Novell/SUSE * Copyright 2009-2010 Canonical Ltd. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation, version 2 of the * License. * * * AppArmor sets confinement on every task, via the the aa_task_cxt and * the aa_task_cxt.profile, both of which are required and are not allowed * to be NULL. The aa_task_cxt is not reference counted and is unique * to each cred (which is reference count). The profile pointed to by * the task_cxt is reference counted. * * TODO * If a task uses change_hat it currently does not return to the old * cred or task context but instead creates a new one. Ideally the task * should return to the previous cred if it has not been modified. * */ #include "include/context.h" #include "include/policy.h" /** * aa_alloc_task_context - allocate a new task_cxt * @flags: gfp flags for allocation * * Returns: allocated buffer or NULL on failure */ struct aa_task_cxt *aa_alloc_task_context(gfp_t flags) { return kzalloc(sizeof(struct aa_task_cxt), flags); } /** * aa_free_task_context - free a task_cxt * @cxt: task_cxt to free (MAYBE NULL) */ void aa_free_task_context(struct aa_task_cxt *cxt) { if (cxt) { aa_put_profile(cxt->profile); aa_put_profile(cxt->previous); aa_put_profile(cxt->onexec); kzfree(cxt); } } /** * aa_dup_task_context - duplicate a task context, incrementing reference counts * @new: a blank task context (NOT NULL) * @old: the task context to copy (NOT NULL) */ void aa_dup_task_context(struct aa_task_cxt *new, const struct aa_task_cxt *old) { *new = *old; aa_get_profile(new->profile); aa_get_profile(new->previous); aa_get_profile(new->onexec); } /** * aa_get_task_profile - Get another task's profile * @task: task to query (NOT NULL) * * Returns: counted reference to @task's profile */ struct aa_profile *aa_get_task_profile(struct task_struct *task) { struct aa_profile *p; rcu_read_lock(); p = aa_get_profile(__aa_task_profile(task)); rcu_read_unlock(); return p; } /** * aa_replace_current_profile - replace the current tasks profiles * @profile: new profile (NOT NULL) * * Returns: 0 or error on failure */ int aa_replace_current_profile(struct aa_profile *profile) { struct aa_task_cxt *cxt = current_cxt(); struct cred *new; BUG_ON(!profile); if (cxt->profile == profile) return 0; new = prepare_creds(); if (!new) return -ENOMEM; cxt = cred_cxt(new); if (unconfined(profile) || (cxt->profile->ns != profile->ns)) /* if switching to unconfined or a different profile namespace * clear out context state */ aa_clear_task_cxt_trans(cxt); /* be careful switching cxt->profile, when racing replacement it * is possible that cxt->profile->replacedby->profile is the reference * keeping @profile valid, so make sure to get its reference before * dropping the reference on cxt->profile */ aa_get_profile(profile); aa_put_profile(cxt->profile); cxt->profile = profile; commit_creds(new); return 0; } /** * aa_set_current_onexec - set the tasks change_profile to happen onexec * @profile: system profile to set at exec (MAYBE NULL to clear value) * * Returns: 0 or error on failure */ int aa_set_current_onexec(struct aa_profile *profile) { struct aa_task_cxt *cxt; struct cred *new = prepare_creds(); if (!new) return -ENOMEM; cxt = cred_cxt(new); aa_get_profile(profile); aa_put_profile(cxt->onexec); cxt->onexec = profile; commit_creds(new); return 0; } /** * aa_set_current_hat - set the current tasks hat * @profile: profile to set as the current hat (NOT NULL) * @token: token value that must be specified to change from the hat * * Do switch of tasks hat. If the task is currently in a hat * validate the token to match. * * Returns: 0 or error on failure */ int aa_set_current_hat(struct aa_profile *profile, u64 token) { struct aa_task_cxt *cxt; struct cred *new = prepare_creds(); if (!new) return -ENOMEM; BUG_ON(!profile); cxt = cred_cxt(new); if (!cxt->previous) { /* transfer refcount */ cxt->previous = cxt->profile; cxt->token = token; } else if (cxt->token == token) { aa_put_profile(cxt->profile); } else { /* previous_profile && cxt->token != token */ abort_creds(new); return -EACCES; } cxt->profile = aa_get_newest_profile(profile); /* clear exec on switching context */ aa_put_profile(cxt->onexec); cxt->onexec = NULL; commit_creds(new); return 0; } /** * aa_restore_previous_profile - exit from hat context restoring the profile * @token: the token that must be matched to exit hat context * * Attempt to return out of a hat to the previous profile. The token * must match the stored token value. * * Returns: 0 or error of failure */ int aa_restore_previous_profile(u64 token) { struct aa_task_cxt *cxt; struct cred *new = prepare_creds(); if (!new) return -ENOMEM; cxt = cred_cxt(new); if (cxt->token != token) { abort_creds(new); return -EACCES; } /* ignore restores when there is no saved profile */ if (!cxt->previous) { abort_creds(new); return 0; } aa_put_profile(cxt->profile); cxt->profile = aa_get_newest_profile(cxt->previous); BUG_ON(!cxt->profile); /* clear exec && prev information when restoring to previous context */ aa_clear_task_cxt_trans(cxt); commit_creds(new); return 0; } .git/tree/?h=nds-private-remove&id=966d2b04e070bc040319aaebfec09e0144dc3341'>4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /sound/soc/spear parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'sound/soc/spear')