• John Johansen's avatar
    apparmor: fix bad lock balance when introspecting policy · ed2c7da3
    John Johansen authored
    BugLink: http://bugs.launchpad.net/bugs/1235977
    
    The profile introspection seq file has a locking bug when policy is viewed
    from a virtual root (task in a policy namespace), introspection from the
    real root is not affected.
    
    The test for root
        while (parent) {
    is correct for the real root, but incorrect for tasks in a policy namespace.
    This allows the task to walk backup the policy tree past its virtual root
    causing it to be unlocked before the virtual root should be in the p_stop
    fn.
    
    This results in the following lockdep back trace:
    [   78.479744] [ BUG: bad unlock balance detected! ]
    [   78.479792] 3.11.0-11-generic #17 Not tainted
    [   78.479838] -------------------------------------
    [   78.479885] grep/2223 is trying to release lock (&ns->lock) at:
    [   78.479952] [<ffffffff817bf3be>] mutex_unlock+0xe/0x10
    [   78.480002] but there are no more locks to release!
    [   78.480037]
    [   78.480037] other info that might help us debug this:
    [   78.480037] 1 lock held by grep/2223:
    [   78.480037]  #0:  (&p->lock){+.+.+.}, at: [<ffffffff812111bd>] seq_read+0x3d/0x3d0
    [   78.480037]
    [   78.480037] stack backtrace:
    [   78.480037] CPU: 0 PID: 2223 Comm: grep Not tainted 3.11.0-11-generic #17
    [   78.480037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    [   78.480037]  ffffffff817bf3be ffff880007763d60 ffffffff817b97ef ffff8800189d2190
    [   78.480037]  ffff880007763d88 ffffffff810e1c6e ffff88001f044730 ffff8800189d2190
    [   78.480037]  ffffffff817bf3be ffff880007763e00 ffffffff810e5bd6 0000000724fe56b7
    [   78.480037] Call Trace:
    [   78.480037]  [<ffffffff817bf3be>] ? mutex_unlock+0xe/0x10
    [   78.480037]  [<ffffffff817b97ef>] dump_stack+0x54/0x74
    [   78.480037]  [<ffffffff810e1c6e>] print_unlock_imbalance_bug+0xee/0x100
    [   78.480037]  [<ffffffff817bf3be>] ? mutex_unlock+0xe/0x10
    [   78.480037]  [<ffffffff810e5bd6>] lock_release_non_nested+0x226/0x300
    [   78.480037]  [<ffffffff817bf2fe>] ? __mutex_unlock_slowpath+0xce/0x180
    [   78.480037]  [<ffffffff817bf3be>] ? mutex_unlock+0xe/0x10
    [   78.480037]  [<ffffffff810e5d5c>] lock_release+0xac/0x310
    [   78.480037]  [<ffffffff817bf2b3>] __mutex_unlock_slowpath+0x83/0x180
    [   78.480037]  [<ffffffff817bf3be>] mutex_unlock+0xe/0x10
    [   78.480037]  [<ffffffff81376c91>] p_stop+0x51/0x90
    [   78.480037]  [<ffffffff81211408>] seq_read+0x288/0x3d0
    [   78.480037]  [<ffffffff811e9d9e>] vfs_read+0x9e/0x170
    [   78.480037]  [<ffffffff811ea8cc>] SyS_read+0x4c/0xa0
    [   78.480037]  [<ffffffff817ccc9d>] system_call_fastpath+0x1a/0x1f
    Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
    Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
    ed2c7da3
apparmorfs.c 23.1 KB