4 files changed, 25 insertions, 9 deletions

diff --git a/include/linux/cred.h b/include/linux/cred.h
index ebbed2ce6637..856d2622d832 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -357,10 +357,8 @@ static inline void put_cred(const struct cred *_cred)
 extern struct user_namespace init_user_ns;
 #ifdef CONFIG_USER_NS
 #define current_user_ns()       (current_cred_xxx(user_ns))
-#define task_user_ns(task)      (task_cred_xxx((task), user_ns))
 #else
 #define current_user_ns()       (&init_user_ns)
-#define task_user_ns(task)      (&init_user_ns)
 #endif
 
 
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 1f5e55dda955..7b09b88862cc 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -215,8 +215,12 @@ ok:
         smp_rmb();
         if (task->mm)
                 dumpable = get_dumpable(task->mm);
-        if (!dumpable  && !ptrace_has_cap(task_user_ns(task), mode))
+        rcu_read_lock();
+        if (!dumpable && !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
+                rcu_read_unlock();
                 return -EPERM;
+        }
+        rcu_read_unlock();
 
         return security_ptrace_access_check(task, mode);
 }
@@ -280,8 +284,10 @@ static int ptrace_attach(struct task_struct *task, long request,
 
         if (seize)
                 flags |= PT_SEIZED;
-        if (ns_capable(task_user_ns(task), CAP_SYS_PTRACE))
+        rcu_read_lock();
+        if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
                 flags |= PT_PTRACE_CAP;
+        rcu_read_unlock();
         task->ptrace = flags;
 
         __ptrace_link(task, current);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2d8927fda712..2f5eb1838b3e 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4029,8 +4029,14 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
                 goto out_free_cpus_allowed;
         }
         retval = -EPERM;
-        if (!check_same_owner(p) && !ns_capable(task_user_ns(p), CAP_SYS_NICE))
-                goto out_unlock;
+        if (!check_same_owner(p)) {
+                rcu_read_lock();
+                if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
+                        rcu_read_unlock();
+                        goto out_unlock;
+                }
+                rcu_read_unlock();
+        }
 
         retval = security_task_setscheduler(p);
         if (retval)
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index b4c29848b49d..0e72239aeb05 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -262,14 +262,18 @@ int yama_ptrace_access_check(struct task_struct *child,
                         /* No additional restrictions. */
                         break;
                 case YAMA_SCOPE_RELATIONAL:
+                        rcu_read_lock();
                         if (!task_is_descendant(current, child) &&
                             !ptracer_exception_found(current, child) &&
-                            !ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
+                            !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
                                 rc = -EPERM;
+                        rcu_read_unlock();
                         break;
                 case YAMA_SCOPE_CAPABILITY:
-                        if (!ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
+                        rcu_read_lock();
+                        if (!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
                                 rc = -EPERM;
+                        rcu_read_unlock();
                         break;
                 case YAMA_SCOPE_NO_ATTACH:
                 default:
@@ -307,8 +311,10 @@ int yama_ptrace_traceme(struct task_struct *parent)
         /* Only disallow PTRACE_TRACEME on more aggressive settings. */
         switch (ptrace_scope) {
         case YAMA_SCOPE_CAPABILITY:
-                if (!ns_capable(task_user_ns(parent), CAP_SYS_PTRACE))
+                rcu_read_lock();
+                if (!ns_capable(__task_cred(parent)->user_ns, CAP_SYS_PTRACE))
                         rc = -EPERM;
+                rcu_read_unlock();
                 break;
         case YAMA_SCOPE_NO_ATTACH:
                 rc = -EPERM;