[PATCH] Fix unserialized task->files changing

Fixed race on put_files_struct on exec with proc.  Restoring files on
current on error path may lead to proc having a pointer to already kfree-d
files_struct.

->files changing at exit.c and khtread.c are safe as exit_files() makes all
things under lock.

Found during OpenVZ stress testing.

[akpm@osdl.org: add export]
Signed-off-by: Pavel Emelianov <xemul@openvz.org>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index dfd8cfb7fb5dcd213ab74c41474c81e06a69f8e1..bb43da5cde5c3ec8dd0ba8f2aeb705b331cb9440 100644 (file)
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1038,10 +1038,8 @@ out_free_interp:
 out_free_file:
        sys_close(elf_exec_fileno);
 out_free_fh:
-       if (files) {
-               put_files_struct(current->files);
-               current->files = files;
-       }
+       if (files)
+               reset_files_struct(current, files);
 out_free_ph:
        kfree(elf_phdata);
        goto out;

diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 66ba137f86618b25044a2beeb2a73a6f1dc81865..1713c48fef5494e5e8ef361a83b5795ecaae4ce9 100644 (file)
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -215,10 +215,8 @@ _error:
        bprm->interp_flags = 0;
        bprm->interp_data = 0;
 _unshare:
-       if (files) {
-               put_files_struct(current->files);
-               current->files = files;
-       }
+       if (files)
+               reset_files_struct(current, files);
        goto _ret;
 }
 

diff --git a/fs/exec.c b/fs/exec.c
index 97df6e0aeaeed58db0f63ab746883ee87c7c1985..a8efe35176b025626e4e49732ec49a1843862250 100644 (file)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -898,8 +898,7 @@ int flush_old_exec(struct linux_binprm * bprm)
        return 0;
 
 mmap_failed:
-       put_files_struct(current->files);
-       current->files = files;
+       reset_files_struct(current, files);
 out:
        return retval;
 }

diff --git a/include/linux/file.h b/include/linux/file.h
index 9f7c2513866f4d1a857398711f09864239b7162c..74183e6f7f458052c72d0bf3e8297c83a32ff18c 100644 (file)
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -112,5 +112,6 @@ struct task_struct;
 
 struct files_struct *get_files_struct(struct task_struct *);
 void FASTCALL(put_files_struct(struct files_struct *fs));
+void reset_files_struct(struct task_struct *, struct files_struct *);
 
 #endif /* __LINUX_FILE_H */

diff --git a/kernel/exit.c b/kernel/exit.c
index d891883420f7bfd64b0cbc29b7003fcd57d526ef..4b6fb054b25d715b906ca60d3b674f1be041d184 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -487,6 +487,18 @@ void fastcall put_files_struct(struct files_struct *files)
 
 EXPORT_SYMBOL(put_files_struct);
 
+void reset_files_struct(struct task_struct *tsk, struct files_struct *files)
+{
+       struct files_struct *old;
+
+       old = tsk->files;
+       task_lock(tsk);
+       tsk->files = files;
+       task_unlock(tsk);
+       put_files_struct(old);
+}
+EXPORT_SYMBOL(reset_files_struct);
+
 static inline void __exit_files(struct task_struct *tsk)
 {
        struct files_struct * files = tsk->files;