Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3b9b8ab6 authored by Kirill Korotaev's avatar Kirill Korotaev Committed by Linus Torvalds
Browse files

[PATCH] Fix unserialized task->files changing 



Fixed race on put_files_struct on exec with proc.  Restoring files on
current on error path may lead to proc having a pointer to already kfree-d
files_struct.

->files changing at exit.c and khtread.c are safe as exit_files() makes all
things under lock.

Found during OpenVZ stress testing.

[akpm@osdl.org: add export]
Signed-off-by: default avatarPavel Emelianov <xemul@openvz.org>
Signed-off-by: default avatarKirill Korotaev <dev@openvz.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent fc09561d

fs/binfmt_elf.c

+2 −4
Original line number Diff line number Diff line
@@ -1038,10 +1038,8 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) 
out_free_file:

	sys_close(elf_exec_fileno);

out_free_fh:

	if (files) {

		put_files_struct(current->files);

		current->files = files;

	}

	if (files)

		reset_files_struct(current, files);

out_free_ph:

	kfree(elf_phdata);

	goto out;

fs/binfmt_misc.c

+2 −4
Original line number Diff line number Diff line
@@ -215,10 +215,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) 
	bprm->interp_flags = 0;

	bprm->interp_data = 0;

_unshare:

	if (files) {

		put_files_struct(current->files);

		current->files = files;

	}

	if (files)

		reset_files_struct(current, files);

	goto _ret;

}

fs/exec.c

+1 −2
Original line number Diff line number Diff line
@@ -898,8 +898,7 @@ int flush_old_exec(struct linux_binprm * bprm) 
	return 0;



mmap_failed:

	put_files_struct(current->files);

	current->files = files;

	reset_files_struct(current, files);

out:

	return retval;

}

include/linux/file.h

+1 −0
Original line number Diff line number Diff line
@@ -112,5 +112,6 @@ struct task_struct; 


struct files_struct *get_files_struct(struct task_struct *);

void FASTCALL(put_files_struct(struct files_struct *fs));

void reset_files_struct(struct task_struct *, struct files_struct *);



#endif /* __LINUX_FILE_H */

kernel/exit.c

+12 −0
Original line number Diff line number Diff line
@@ -487,6 +487,18 @@ void fastcall put_files_struct(struct files_struct *files) 


EXPORT_SYMBOL(put_files_struct);



void reset_files_struct(struct task_struct *tsk, struct files_struct *files)

{

	struct files_struct *old;



	old = tsk->files;

	task_lock(tsk);

	tsk->files = files;

	task_unlock(tsk);

	put_files_struct(old);

}

EXPORT_SYMBOL(reset_files_struct);



static inline void __exit_files(struct task_struct *tsk)

{

	struct files_struct * files = tsk->files;