Commit 3b9b8ab6 authored by Kirill Korotaev's avatar Kirill Korotaev Committed by Linus Torvalds

[PATCH] Fix unserialized task->files changing

Fixed race on put_files_struct on exec with proc.  Restoring files on
current on error path may lead to proc having a pointer to already kfree-d
files_struct.

->files changing at exit.c and khtread.c are safe as exit_files() makes all
things under lock.

Found during OpenVZ stress testing.

[akpm@osdl.org: add export]
Signed-off-by: default avatarPavel Emelianov <xemul@openvz.org>
Signed-off-by: default avatarKirill Korotaev <dev@openvz.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent fc09561d
...@@ -1038,10 +1038,8 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) ...@@ -1038,10 +1038,8 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
out_free_file: out_free_file:
sys_close(elf_exec_fileno); sys_close(elf_exec_fileno);
out_free_fh: out_free_fh:
if (files) { if (files)
put_files_struct(current->files); reset_files_struct(current, files);
current->files = files;
}
out_free_ph: out_free_ph:
kfree(elf_phdata); kfree(elf_phdata);
goto out; goto out;
......
...@@ -215,10 +215,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) ...@@ -215,10 +215,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
bprm->interp_flags = 0; bprm->interp_flags = 0;
bprm->interp_data = 0; bprm->interp_data = 0;
_unshare: _unshare:
if (files) { if (files)
put_files_struct(current->files); reset_files_struct(current, files);
current->files = files;
}
goto _ret; goto _ret;
} }
......
...@@ -898,8 +898,7 @@ int flush_old_exec(struct linux_binprm * bprm) ...@@ -898,8 +898,7 @@ int flush_old_exec(struct linux_binprm * bprm)
return 0; return 0;
mmap_failed: mmap_failed:
put_files_struct(current->files); reset_files_struct(current, files);
current->files = files;
out: out:
return retval; return retval;
} }
......
...@@ -112,5 +112,6 @@ struct task_struct; ...@@ -112,5 +112,6 @@ struct task_struct;
struct files_struct *get_files_struct(struct task_struct *); struct files_struct *get_files_struct(struct task_struct *);
void FASTCALL(put_files_struct(struct files_struct *fs)); void FASTCALL(put_files_struct(struct files_struct *fs));
void reset_files_struct(struct task_struct *, struct files_struct *);
#endif /* __LINUX_FILE_H */ #endif /* __LINUX_FILE_H */
...@@ -487,6 +487,18 @@ void fastcall put_files_struct(struct files_struct *files) ...@@ -487,6 +487,18 @@ void fastcall put_files_struct(struct files_struct *files)
EXPORT_SYMBOL(put_files_struct); EXPORT_SYMBOL(put_files_struct);
void reset_files_struct(struct task_struct *tsk, struct files_struct *files)
{
struct files_struct *old;
old = tsk->files;
task_lock(tsk);
tsk->files = files;
task_unlock(tsk);
put_files_struct(old);
}
EXPORT_SYMBOL(reset_files_struct);
static inline void __exit_files(struct task_struct *tsk) static inline void __exit_files(struct task_struct *tsk)
{ {
struct files_struct * files = tsk->files; struct files_struct * files = tsk->files;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment