Fixed race on put_files_struct on exec with proc.
Restoring files on current on error path may lead
to proc having a pointer to already kfree-d files_struct.
->files changing at exit.c and khtread.c are safe as
exit_files() makes all things under lock.
v2 patch changes:
- introduced reset_files_struct() as Christoph Hellwig suggested
Found during OpenVZ stress testing.
Signed-Off-By: Pavel Emelianov <[email protected]>
Signed-Off-By: Kirill Korotaev <[email protected]>
--- ./fs/binfmt_elf.c.rfs 2006-08-08 15:01:44.000000000 +0400
+++ ./fs/binfmt_elf.c 2006-08-08 15:07:49.000000000 +0400
@@ -1037,10 +1037,8 @@ out_free_interp:
out_free_file:
sys_close(elf_exec_fileno);
out_free_fh:
- if (files) {
- put_files_struct(current->files);
- current->files = files;
- }
+ if (files)
+ reset_files_struct(current, files);
out_free_ph:
kfree(elf_phdata);
goto out;
--- ./fs/binfmt_misc.c.rfs 2006-08-08 15:01:44.000000000 +0400
+++ ./fs/binfmt_misc.c 2006-08-08 15:09:46.000000000 +0400
@@ -215,10 +215,8 @@ _error:
bprm->interp_flags = 0;
bprm->interp_data = 0;
_unshare:
- if (files) {
- put_files_struct(current->files);
- current->files = files;
- }
+ if (files)
+ reset_files_struct(current, files);
goto _ret;
}
--- ./fs/exec.c.rfs 2006-08-08 15:01:44.000000000 +0400
+++ ./fs/exec.c 2006-08-08 15:10:09.000000000 +0400
@@ -903,8 +903,7 @@ int flush_old_exec(struct linux_binprm *
return 0;
mmap_failed:
- put_files_struct(current->files);
- current->files = files;
+ reset_files_struct(current, files);
out:
return retval;
}
--- ./include/linux/file.h.rfs 2006-04-21 11:59:36.000000000 +0400
+++ ./include/linux/file.h 2006-08-08 15:08:19.000000000 +0400
@@ -112,5 +112,6 @@ struct task_struct;
struct files_struct *get_files_struct(struct task_struct *);
void FASTCALL(put_files_struct(struct files_struct *fs));
+void reset_files_struct(struct task_struct *, struct files_struct *);
#endif /* __LINUX_FILE_H */
--- ./kernel/exit.c.rfs 2006-08-08 15:01:44.000000000 +0400
+++ ./kernel/exit.c 2006-08-08 15:13:40.000000000 +0400
@@ -487,6 +487,17 @@ void fastcall put_files_struct(struct fi
EXPORT_SYMBOL(put_files_struct);
+void reset_files_struct(struct task_struct *tsk, struct files_struct *files)
+{
+ struct files_struct *old;
+
+ old = tsk->files;
+ task_lock(tsk);
+ tsk->files = files;
+ task_unlock(tsk);
+ put_files_struct(old);
+}
+
static inline void __exit_files(struct task_struct *tsk)
{
struct files_struct * files = tsk->files;
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
