lkml.org 
[lkml]   [2003]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [PATCH] 2.4: Fix steal_locks race
From
On Fri, Aug 08, 2003 at 08:53:21PM +1000, herbert wrote:
>
> The steal_locks() call in binfmt_elf.c is buggy. It steals locks from
> a files entry whose reference was dropped much earlier. This allows it
> to steal other process's locks.
>
> The following patch calls steal_locks() earlier so that this does not
> happen.

My patch is buggy too. If a file is closed by another clone between
the two steal_locks calls the lock will again be lost. Fortunately
this much harder to trigger than the previous bug.

The following patch fixes that.
--
Debian GNU/Linux 3.0 is out! ( http://www.debian.org/ )
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--- kernel-source-2.4/fs/binfmt_elf.c.orig 2003-08-09 10:43:56.000000000 +1000
+++ kernel-source-2.4/fs/binfmt_elf.c 2003-08-09 10:57:29.000000000 +1000
@@ -480,7 +480,6 @@
files = current->files; /* Refcounted so ok */
if(unshare_files() < 0)
goto out_free_ph;
- steal_locks(files, current->files);

/* exec will make our files private anyway, but for the a.out
loader stuff we need to do it earlier */
@@ -603,6 +602,7 @@
goto out_free_dentry;

/* Discard our unneeded old files struct */
+ steal_locks(files, current->files);
put_files_struct(files);

/* OK, This is the point of no return */
@@ -813,7 +813,6 @@
out_free_fh:
ftmp = current->files;
current->files = files;
- steal_locks(ftmp, current->files);
put_files_struct(ftmp);
out_free_ph:
kfree(elf_phdata);
\
 
 \ /
  Last update: 2005-03-22 13:47    [W:0.202 / U:0.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site