iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix race between proc_readdir and remove_proc_entry

Browse Source 
Fix the following race:

proc_readdir				remove_proc_entry
============				=================

spin_lock(&proc_subdir_lock);
[choose PDE to start filldir from]
spin_unlock(&proc_subdir_lock);
					spin_lock(&proc_subdir_lock);
					[find PDE]
					[free PDE, refcount is 0]
					spin_unlock(&proc_subdir_lock);
		    /* boom */
if (filldir(dirent, de->name, ...

[de_put on error path --adobriyan]
Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Darrick J. Wong 2007-05-08 00:25:47 -07:00 committed by Linus Torvalds
parent 7695650a92
commit 59cd0cbc75
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
fs/proc/generic.c
View File

@ -478,14 +478,21 @@ int proc_readdir(struct file * filp,
}
do {
struct proc_dir_entry *next;
/* filldir passes info to user space */
de_get(de);
spin_unlock(&proc_subdir_lock);
if (filldir(dirent, de->name, de->namelen, filp->f_pos,
de->low_ino, de->mode >> 12) < 0)
de->low_ino, de->mode >> 12) < 0) {
de_put(de);
goto out;
}
spin_lock(&proc_subdir_lock);
filp->f_pos++;
de = de->next;
next = de->next;
de_put(de);
de = next;
} while (de);
spin_unlock(&proc_subdir_lock);
}