userns: Kill task_user_ns

The task_user_ns function hides the fact that it is getting the user
namespace from struct cred on the task.  struct cred may go away as
soon as the rcu lock is released.  This leads to a race where we
can dereference a stale user namespace pointer.

To make it obvious a struct cred is involved kill task_user_ns.

To kill the race modify the users of task_user_ns to only
reference the user namespace while the rcu lock is held.

Cc: Kees Cook <keescook@chromium.org>
Cc: James Morris <james.l.morris@oracle.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

2 files changed, 16 insertions, 4 deletions

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 1f5e55dda955..7b09b88862cc 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -215,8 +215,12 @@ ok:
         smp_rmb();
         if (task->mm)
                 dumpable = get_dumpable(task->mm);
-        if (!dumpable  && !ptrace_has_cap(task_user_ns(task), mode))
+        rcu_read_lock();
+        if (!dumpable && !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
+                rcu_read_unlock();
                 return -EPERM;
+        }
+        rcu_read_unlock();
 
         return security_ptrace_access_check(task, mode);
 }
@@ -280,8 +284,10 @@ static int ptrace_attach(struct task_struct *task, long request,
 
         if (seize)
                 flags |= PT_SEIZED;
-        if (ns_capable(task_user_ns(task), CAP_SYS_PTRACE))
+        rcu_read_lock();
+        if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
                 flags |= PT_PTRACE_CAP;
+        rcu_read_unlock();
         task->ptrace = flags;
 
         __ptrace_link(task, current);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2d8927fda712..2f5eb1838b3e 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4029,8 +4029,14 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
                 goto out_free_cpus_allowed;
         }
         retval = -EPERM;
-        if (!check_same_owner(p) && !ns_capable(task_user_ns(p), CAP_SYS_NICE))
-                goto out_unlock;
+        if (!check_same_owner(p)) {
+                rcu_read_lock();
+                if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
+                        rcu_read_unlock();
+                        goto out_unlock;
+                }
+                rcu_read_unlock();
+        }
 
         retval = security_task_setscheduler(p);
         if (retval)