Al Viro 24dff96a37 fix misuses of f_count() in ppp and netlink
we used to check for "nobody else could start doing anything with
that opened file" by checking that refcount was 2 or less - one
for descriptor table and one we'd acquired in fget() on the way to
wherever we are.  That was race-prone (somebody else might have
had a reference to descriptor table and do fget() just as we'd
been checking) and it had become flat-out incorrect back when
we switched to fget_light() on those codepaths - unlike fget(),
it doesn't grab an extra reference unless the descriptor table
is shared.  The same change allowed a race-free check, though -
we are safe exactly when refcount is less than 2.

It was a long time ago; pre-2.6.12 for ioctl() (the codepath leading
to ppp one) and 2.6.17 for sendmsg() (netlink one).  OTOH,
netlink hadn't grown that check until 3.9 and ppp used to live
in drivers/net, not drivers/net/ppp until 3.1.  The bug existed
well before that, though, and the same fix used to apply in old
location of file.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-10-09 02:39:17 -04:00
..
2014-09-15 16:20:56 -07:00
2014-10-09 02:39:07 -04:00
2014-09-09 13:52:18 -07:00
2014-07-23 10:18:07 -07:00
2014-07-23 00:51:30 +02:00
2014-10-09 02:39:11 -04:00
2014-08-06 20:06:14 -07:00
2014-08-05 21:16:46 -07:00
2014-08-15 17:06:40 -04:00
2014-09-24 08:53:33 -07:00
2014-09-06 12:12:09 -07:00
2014-09-25 11:55:50 +01:00
2014-09-24 09:46:29 -07:00
2014-07-30 00:23:09 +02:00
2014-08-08 11:14:29 -07:00
2014-08-25 15:39:22 -04:00
2014-10-09 02:39:12 -04:00
2014-09-08 16:33:56 -07:00
2014-09-11 16:52:29 -07:00
2014-08-04 18:34:04 -07:00