[apparmor] [PATCH 10/10] apparmor: explain why apparmor_getprocattr cannot use the condref helpers

[Ryan Lee]

Signed-off-by: Ryan Lee <ryan.lee at canonical.com>
---
 security/apparmor/lsm.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 3168063e8eda..aafd91692aef 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -827,6 +827,13 @@ static int apparmor_getprocattr(struct task_struct *task, const char *name,
 	int error = -ENOENT;
 	struct aa_label *label = NULL;
 
+	/* Because __task_cred and task_ctx pointers are RCU protected,
+	 * we need to obtain a refcount to them under the RCU read lock
+	 * to prevent them from being cleaned up as an RCU callback.
+	 * Thus, we cannot use the condref versions without moving
+	 * aa_getprocattr into the RCU critical section and reworking it
+	 * to avoid e.g. GFP_KERNEL allocations.
+	 */
 	rcu_read_lock();
 	if (strcmp(name, "current") == 0)
 		label = aa_get_newest_cred_label(__task_cred(task));
-- 
2.43.0