1 files changed, 14 insertions, 7 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9b40f4c0ac70..4796ddd4e721 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2170,8 +2170,9 @@ static inline void flush_unauthorized_files(const struct cred *cred,
 
         tty = get_current_tty();
         if (tty) {
-                file_list_lock();
+                spin_lock(&tty_files_lock);
                 if (!list_empty(&tty->tty_files)) {
+                        struct tty_file_private *file_priv;
                         struct inode *inode;
 
                         /* Revalidate access to controlling tty.
@@ -2179,14 +2180,16 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                            than using file_has_perm, as this particular open
                            file may belong to another process and we are only
                            interested in the inode-based check here. */
-                        file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
+                        file_priv = list_first_entry(&tty->tty_files,
+                                                struct tty_file_private, list);
+                        file = file_priv->file;
                         inode = file->f_path.dentry->d_inode;
                         if (inode_has_perm(cred, inode,
                                            FILE__READ | FILE__WRITE, NULL)) {
                                 drop_tty = 1;
                         }
                 }
-                file_list_unlock();
+                spin_unlock(&tty_files_lock);
                 tty_kref_put(tty);
         }
         /* Reset controlling tty. */
@@ -2284,12 +2287,15 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
                           PROCESS__RLIMITINH, NULL);
         if (rc) {
+                /* protect against do_prlimit() */
+                task_lock(current);
                 for (i = 0; i < RLIM_NLIMITS; i++) {
                         rlim = current->signal->rlim + i;
                         initrlim = init_task.signal->rlim + i;
                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
                 }
-                update_rlimit_cpu(current->signal->rlim[RLIMIT_CPU].rlim_cur);
+                task_unlock(current);
+                update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
         }
 }
 
@@ -3333,16 +3339,17 @@ static int selinux_task_getioprio(struct task_struct *p)
         return current_has_perm(p, PROCESS__GETSCHED);
 }
 
-static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
+static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
+                struct rlimit *new_rlim)
 {
-        struct rlimit *old_rlim = current->signal->rlim + resource;
+        struct rlimit *old_rlim = p->signal->rlim + resource;
 
         /* Control the ability to change the hard limit (whether
            lowering or raising it), so that the hard limit can
            later be used as a safe reset point for the soft limit
            upon context transitions.  See selinux_bprm_committing_creds. */
         if (old_rlim->rlim_max != new_rlim->rlim_max)
-                return current_has_perm(current, PROCESS__SETRLIMIT);
+                return current_has_perm(p, PROCESS__SETRLIMIT);
 
         return 0;
 }