lkml.org 
[lkml]   [2009]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] exec: fix set_binfmt() vs sys_delete_module() race
sys_delete_module() can set MODULE_STATE_GOING after search_binary_handler()
does try_module_get(). In this case set_binfmt()->try_module_get() fails but
since none of the callers check the returned error, the task will run with
the wrong old ->binfmt.

The proper fix should change all ->load_binary() methods, but we can rely
on fact that the caller must hold a reference to binfmt->module and use
__module_get() which never fails.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>

--- WAIT/include/linux/binfmts.h~SET_BINFMT 2009-05-03 17:15:27.000000000 +0200
+++ WAIT/include/linux/binfmts.h 2009-07-24 19:02:19.000000000 +0200
@@ -119,7 +119,7 @@ extern int bprm_mm_init(struct linux_bin
extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
extern void install_exec_creds(struct linux_binprm *bprm);
extern void do_coredump(long signr, int exit_code, struct pt_regs *regs);
-extern int set_binfmt(struct linux_binfmt *new);
+extern void set_binfmt(struct linux_binfmt *new);
extern void free_bprm(struct linux_binprm *);

#endif /* __KERNEL__ */
--- WAIT/fs/exec.c~SET_BINFMT 2009-07-02 19:27:36.000000000 +0200
+++ WAIT/fs/exec.c 2009-07-24 19:00:40.000000000 +0200
@@ -1377,18 +1377,14 @@ out_ret:
return retval;
}

-int set_binfmt(struct linux_binfmt *new)
+void set_binfmt(struct linux_binfmt *new)
{
- struct linux_binfmt *old = current->binfmt;
+ if (current->binfmt)
+ module_put(current->binfmt->module);

- if (new) {
- if (!try_module_get(new->module))
- return -1;
- }
current->binfmt = new;
- if (old)
- module_put(old->module);
- return 0;
+ if (new)
+ __module_get(new->module);
}

EXPORT_SYMBOL(set_binfmt);


\
 
 \ /
  Last update: 2009-07-24 19:25    [W:0.051 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site