lkml.org 
[lkml]   [2006]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] unserialized task->files changing (v2)
    Fixed race on put_files_struct on exec with proc.
    Restoring files on current on error path may lead
    to proc having a pointer to already kfree-d files_struct.

    ->files changing at exit.c and khtread.c are safe as
    exit_files() makes all things under lock.

    v2 patch changes:
    - introduced reset_files_struct() as Christoph Hellwig suggested

    Found during OpenVZ stress testing.

    Signed-Off-By: Pavel Emelianov <xemul@openvz.org>
    Signed-Off-By: Kirill Korotaev <dev@openvz.org>

    --- ./fs/binfmt_elf.c.rfs 2006-08-08 15:01:44.000000000 +0400
    +++ ./fs/binfmt_elf.c 2006-08-08 15:07:49.000000000 +0400
    @@ -1037,10 +1037,8 @@ out_free_interp:
    out_free_file:
    sys_close(elf_exec_fileno);
    out_free_fh:
    - if (files) {
    - put_files_struct(current->files);
    - current->files = files;
    - }
    + if (files)
    + reset_files_struct(current, files);
    out_free_ph:
    kfree(elf_phdata);
    goto out;
    --- ./fs/binfmt_misc.c.rfs 2006-08-08 15:01:44.000000000 +0400
    +++ ./fs/binfmt_misc.c 2006-08-08 15:09:46.000000000 +0400
    @@ -215,10 +215,8 @@ _error:
    bprm->interp_flags = 0;
    bprm->interp_data = 0;
    _unshare:
    - if (files) {
    - put_files_struct(current->files);
    - current->files = files;
    - }
    + if (files)
    + reset_files_struct(current, files);
    goto _ret;
    }

    --- ./fs/exec.c.rfs 2006-08-08 15:01:44.000000000 +0400
    +++ ./fs/exec.c 2006-08-08 15:10:09.000000000 +0400
    @@ -903,8 +903,7 @@ int flush_old_exec(struct linux_binprm *
    return 0;

    mmap_failed:
    - put_files_struct(current->files);
    - current->files = files;
    + reset_files_struct(current, files);
    out:
    return retval;
    }
    --- ./include/linux/file.h.rfs 2006-04-21 11:59:36.000000000 +0400
    +++ ./include/linux/file.h 2006-08-08 15:08:19.000000000 +0400
    @@ -112,5 +112,6 @@ struct task_struct;

    struct files_struct *get_files_struct(struct task_struct *);
    void FASTCALL(put_files_struct(struct files_struct *fs));
    +void reset_files_struct(struct task_struct *, struct files_struct *);

    #endif /* __LINUX_FILE_H */
    --- ./kernel/exit.c.rfs 2006-08-08 15:01:44.000000000 +0400
    +++ ./kernel/exit.c 2006-08-08 15:13:40.000000000 +0400
    @@ -487,6 +487,17 @@ void fastcall put_files_struct(struct fi

    EXPORT_SYMBOL(put_files_struct);

    +void reset_files_struct(struct task_struct *tsk, struct files_struct *files)
    +{
    + struct files_struct *old;
    +
    + old = tsk->files;
    + task_lock(tsk);
    + tsk->files = files;
    + task_unlock(tsk);
    + put_files_struct(old);
    +}
    +
    static inline void __exit_files(struct task_struct *tsk)
    {
    struct files_struct * files = tsk->files;
    \
     
     \ /
      Last update: 2006-08-08 13:33    [W:0.027 / U:122.228 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site