diff options
author | Kirill Korotaev <dev@sw.ru> | 2006-09-29 05:00:05 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-09-29 12:18:12 -0400 |
commit | 3b9b8ab65d8eed784b9164d03807cb2bda7b5cd6 (patch) | |
tree | 104c7b01768acd7e152cbf66e4868a73804e8af9 /fs | |
parent | fc09561d6392771a392dea55c287de7e849b6b63 (diff) |
[PATCH] Fix unserialized task->files changing
Fixed race on put_files_struct on exec with proc. Restoring files on
current on error path may lead to proc having a pointer to already kfree-d
files_struct.
->files changing at exit.c and khtread.c are safe as exit_files() makes all
things under lock.
Found during OpenVZ stress testing.
[akpm@osdl.org: add export]
Signed-off-by: Pavel Emelianov <xemul@openvz.org>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/binfmt_elf.c | 6 | ||||
-rw-r--r-- | fs/binfmt_misc.c | 6 | ||||
-rw-r--r-- | fs/exec.c | 3 |
3 files changed, 5 insertions, 10 deletions
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index dfd8cfb7fb5..bb43da5cde5 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c | |||
@@ -1038,10 +1038,8 @@ out_free_interp: | |||
1038 | out_free_file: | 1038 | out_free_file: |
1039 | sys_close(elf_exec_fileno); | 1039 | sys_close(elf_exec_fileno); |
1040 | out_free_fh: | 1040 | out_free_fh: |
1041 | if (files) { | 1041 | if (files) |
1042 | put_files_struct(current->files); | 1042 | reset_files_struct(current, files); |
1043 | current->files = files; | ||
1044 | } | ||
1045 | out_free_ph: | 1043 | out_free_ph: |
1046 | kfree(elf_phdata); | 1044 | kfree(elf_phdata); |
1047 | goto out; | 1045 | goto out; |
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index 66ba137f866..1713c48fef5 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c | |||
@@ -215,10 +215,8 @@ _error: | |||
215 | bprm->interp_flags = 0; | 215 | bprm->interp_flags = 0; |
216 | bprm->interp_data = 0; | 216 | bprm->interp_data = 0; |
217 | _unshare: | 217 | _unshare: |
218 | if (files) { | 218 | if (files) |
219 | put_files_struct(current->files); | 219 | reset_files_struct(current, files); |
220 | current->files = files; | ||
221 | } | ||
222 | goto _ret; | 220 | goto _ret; |
223 | } | 221 | } |
224 | 222 | ||
@@ -898,8 +898,7 @@ int flush_old_exec(struct linux_binprm * bprm) | |||
898 | return 0; | 898 | return 0; |
899 | 899 | ||
900 | mmap_failed: | 900 | mmap_failed: |
901 | put_files_struct(current->files); | 901 | reset_files_struct(current, files); |
902 | current->files = files; | ||
903 | out: | 902 | out: |
904 | return retval; | 903 | return retval; |
905 | } | 904 | } |