lkml.org 
[lkml]   [2005]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[Patch] vfs: increase scope of critical locked path in fget_light to avoid race
    Patch to increase the scope of the locked critical path in fget_light to include
    the conditional where there is only one reference to the passed file_struct.
    Currently there is no protection against someone modifying that reference count
    after it has been read in fget_light and falling into a code path where the fd
    array is modified. The result is a race condition that leads to a corrupted fd
    table and potential oopses. This patch corrects that by enforcing the locking
    protocol that is used by all other accessors of the fd table on the 1 reference
    case in fget_light. Smoke tested by me, with no failures.

    Signed-off-by: Neil Horman <nhorman@redhat.com>

    file_table.c | 4 ++--
    1 files changed, 2 insertions(+), 2 deletions(-)


    --- linux-2.6.git/fs/file_table.c.racefix 2005-05-20 07:32:12.000000000 -0400
    +++ linux-2.6.git/fs/file_table.c 2005-05-20 08:53:03.000000000 -0400
    @@ -174,17 +174,17 @@ struct file fastcall *fget_light(unsigne
    struct files_struct *files = current->files;

    *fput_needed = 0;
    + spin_lock(&files->file_lock);
    if (likely((atomic_read(&files->count) == 1))) {
    file = fcheck_files(files, fd);
    } else {
    - spin_lock(&files->file_lock);
    file = fcheck_files(files, fd);
    if (file) {
    get_file(file);
    *fput_needed = 1;
    }
    - spin_unlock(&files->file_lock);
    }
    + spin_unlock(&files->file_lock);
    return file;
    }

    --
    /***************************************************
    *Neil Horman
    *Software Engineer
    *Red Hat, Inc.
    *nhorman@redhat.com
    *gpg keyid: 1024D / 0x92A74FA1
    *http://pgp.mit.edu
    ***************************************************/[unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2005-05-20 15:27    [W:0.037 / U:2.052 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site