Messages in this thread | | | Date | Mon, 17 May 2010 16:31:38 +0200 | From | Stanislaw Gruszka <> | Subject | Re: [PATCH 2/3] posix_timer: fix error path in timer_create |
| |
On Mon, 17 May 2010 17:41:43 +0400 Andrey Vagin <avagin@openvz.org> wrote:
> move CLOCK_DISPATCH(which_clock, timer_create, (new_timer)) after all > possible EFAULT errors. > > *_timer_create may allocate/get resources. > (for example posix_cpu_timer_create does get_task_struct) > > Signed-off-by: Andrey Vagin <avagin@openvz.org> > --- > kernel/posix-timers.c | 16 ++++++++-------- > 1 files changed, 8 insertions(+), 8 deletions(-) > > diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c > index 5555e7c..8393624 100644 > --- a/kernel/posix-timers.c > +++ b/kernel/posix-timers.c > @@ -555,14 +555,6 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, > goto out; > } > > - it_id_set = IT_ID_SET; > - new_timer->it_id = (timer_t) new_timer_id; > - new_timer->it_clock = which_clock; > - new_timer->it_overrun = -1; > - error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); > - if (error) > - goto out; > - > if (copy_to_user(created_timer_id, > &new_timer_id, sizeof (new_timer_id))) { > error = -EFAULT; > @@ -593,6 +585,14 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, > new_timer->sigq->info.si_tid = new_timer->it_id; > new_timer->sigq->info.si_code = SI_TIMER; > > + it_id_set = IT_ID_SET; > + new_timer->it_id = (timer_t) new_timer_id;
This part should not be moved, this make possible leak of idr entry .
> + new_timer->it_clock = which_clock; > + new_timer->it_overrun = -1;
I'm not so convenient of moving this as well.
> + error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); > + if (error) > + goto out; > + > spin_lock_irq(¤t->sighand->siglock); > new_timer->it_signal = current->signal; > list_add(&new_timer->list, ¤t->signal->posix_timers);
Thanks Stanislaw
| |