1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Wed, 11 Oct 2017 17:43:49 +0200
Subject: apparmor: use a locallock instead preempt_disable()
Origin: https://www.kernel.org/pub/linux/kernel/projects/rt/5.2/older/patches-5.2.17-rt9.tar.xz
get_buffers() disables preemption which acts as a lock for the per-CPU
variable. Since we can't disable preemption here on RT, a local_lock is
lock is used in order to remain on the same CPU and not to have more
than one user within the critical section.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
security/apparmor/include/path.h | 19 ++++++++++++++++---
security/apparmor/lsm.c | 2 +-
2 files changed, 17 insertions(+), 4 deletions(-)
--- a/security/apparmor/include/path.h
+++ b/security/apparmor/include/path.h
@@ -36,8 +36,10 @@ struct aa_buffers {
#include <linux/percpu.h>
#include <linux/preempt.h>
+#include <linux/locallock.h>
DECLARE_PER_CPU(struct aa_buffers, aa_buffers);
+DECLARE_LOCAL_IRQ_LOCK(aa_buffers_lock);
#define ASSIGN(FN, A, X, N) ((X) = FN(A, N))
#define EVAL1(FN, A, X) ASSIGN(FN, A, X, 0) /*X = FN(0)*/
@@ -47,7 +49,17 @@ DECLARE_PER_CPU(struct aa_buffers, aa_bu
#define for_each_cpu_buffer(I) for ((I) = 0; (I) < MAX_PATH_BUFFERS; (I)++)
-#ifdef CONFIG_DEBUG_PREEMPT
+#ifdef CONFIG_PREEMPT_RT_BASE
+static inline void AA_BUG_PREEMPT_ENABLED(const char *s)
+{
+ struct local_irq_lock *lv;
+
+ lv = this_cpu_ptr(&aa_buffers_lock);
+ WARN_ONCE(lv->owner != current,
+ "__get_buffer without aa_buffers_lock\n");
+}
+
+#elif defined(CONFIG_DEBUG_PREEMPT)
#define AA_BUG_PREEMPT_ENABLED(X) AA_BUG(preempt_count() <= 0, X)
#else
#define AA_BUG_PREEMPT_ENABLED(X) /* nop */
@@ -63,14 +75,15 @@ DECLARE_PER_CPU(struct aa_buffers, aa_bu
#define get_buffers(X...) \
do { \
- struct aa_buffers *__cpu_var = get_cpu_ptr(&aa_buffers); \
+ struct aa_buffers *__cpu_var; \
+ __cpu_var = get_locked_ptr(aa_buffers_lock, &aa_buffers); \
__get_buffers(__cpu_var, X); \
} while (0)
#define put_buffers(X, Y...) \
do { \
__put_buffers(X, Y); \
- put_cpu_ptr(&aa_buffers); \
+ put_locked_ptr(aa_buffers_lock, &aa_buffers); \
} while (0)
#endif /* __AA_PATH_H */
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -44,7 +44,7 @@
int apparmor_initialized;
DEFINE_PER_CPU(struct aa_buffers, aa_buffers);
-
+DEFINE_LOCAL_IRQ_LOCK(aa_buffers_lock);
/*
* LSM hook functions
|
