From: Herbert Xu <herbert@gondor.apana.org.au>
To: Marcelo Tosatti <marcelo@conectiva.com.br>,
Alan Cox <alan@lxorguk.ukuu.org.uk>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: [PATCH] 2.4: Fix steal_locks race
Date: Fri, 8 Aug 2003 20:53:21 +1000 [thread overview]
Message-ID: <20030808105321.GA5096@gondor.apana.org.au> (raw)
[-- Attachment #1: Type: text/plain, Size: 492 bytes --]
Hi:
The steal_locks() call in binfmt_elf.c is buggy. It steals locks from
a files entry whose reference was dropped much earlier. This allows it
to steal other process's locks.
The following patch calls steal_locks() earlier so that this does not
happen.
Cheers,
--
Debian GNU/Linux 3.0 is out! ( http://www.debian.org/ )
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[-- Attachment #2: p --]
[-- Type: text/plain, Size: 770 bytes --]
--- kernel-source-2.4/fs/binfmt_elf.c.orig 2003-08-08 20:46:56.000000000 +1000
+++ kernel-source-2.4/fs/binfmt_elf.c 2003-08-08 20:47:05.000000000 +1000
@@ -480,6 +480,7 @@
files = current->files; /* Refcounted so ok */
if(unshare_files() < 0)
goto out_free_ph;
+ steal_locks(files, current->files);
/* exec will make our files private anyway, but for the a.out
loader stuff we need to do it earlier */
@@ -797,7 +798,6 @@
if (current->ptrace & PT_PTRACED)
send_sig(SIGTRAP, current, 0);
retval = 0;
- steal_locks(files, current->files);
out:
return retval;
@@ -813,6 +813,7 @@
out_free_fh:
ftmp = current->files;
current->files = files;
+ steal_locks(ftmp, current->files);
put_files_struct(ftmp);
out_free_ph:
kfree(elf_phdata);
next reply other threads:[~2003-08-08 10:54 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-08-08 10:53 Herbert Xu [this message]
2003-08-09 1:07 ` [PATCH] 2.4: Fix steal_locks race Herbert Xu
2003-08-09 1:11 ` [PATCH] 2.4: Restore current->files in flush_old_exec Herbert Xu
2003-08-09 1:48 ` Andreas Gruenbacher
2003-08-09 1:48 ` Herbert Xu
2003-08-09 2:20 ` Andreas Gruenbacher
2003-08-09 2:53 ` Herbert Xu
2003-08-09 3:01 ` Andreas Gruenbacher
2003-08-09 3:19 ` Andreas Gruenbacher
[not found] ` <Pine.LNX.4.53.0308090554160.18879@Chaos.suse.de>
[not found] ` <20030809100518.GA14688@gondor.apana.org.au>
2003-08-09 10:41 ` Andreas Gruenbacher
2003-08-09 1:46 ` [PATCH] 2.4: Fix steal_locks race Andreas Gruenbacher
2003-08-09 2:04 ` Andreas Gruenbacher
2003-08-09 2:52 ` Herbert Xu
2003-08-09 3:13 ` Andreas Gruenbacher
2003-08-09 3:19 ` Herbert Xu
2003-08-09 3:30 ` Andreas Gruenbacher
2003-08-09 2:59 ` Andreas Gruenbacher
2003-08-09 3:04 ` Herbert Xu
2003-08-09 3:17 ` Andreas Gruenbacher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030808105321.GA5096@gondor.apana.org.au \
--to=herbert@gondor.apana.org.au \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=marcelo@conectiva.com.br \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).