1. 24 4月, 2009 2 次提交
    • O
      check_unsafe_exec: s/lock_task_sighand/rcu_read_lock/ · 437f7fdb
      Oleg Nesterov 提交于
      write_lock(&current->fs->lock) guarantees we can't wrongly miss
      LSM_UNSAFE_SHARE, this is what we care about. Use rcu_read_lock()
      instead of ->siglock to iterate over the sub-threads. We must see
      all CLONE_THREAD|CLONE_FS threads which didn't pass exit_fs(), it
      takes fs->lock too.
      
      With or without this patch we can miss the freshly cloned thread
      and set LSM_UNSAFE_SHARE, we don't care.
      Signed-off-by: NOleg Nesterov <oleg@redhat.com>
      Acked-by: NRoland McGrath <roland@redhat.com>
      [ Fixed lock/unlock typo  - Hugh ]
      Acked-by: NHugh Dickins <hugh@veritas.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      437f7fdb
    • O
      do_execve() must not clear fs->in_exec if it was set by another thread · 8c652f96
      Oleg Nesterov 提交于
      If do_execve() fails after check_unsafe_exec(), it clears fs->in_exec
      unconditionally. This is wrong if we race with our sub-thread which
      also does do_execve:
      
      	Two threads T1 and T2 and another process P, all share the same
      	->fs.
      
      	T1 starts do_execve(BAD_FILE). It calls check_unsafe_exec(), since
      	->fs is shared, we set LSM_UNSAFE but not ->in_exec.
      
      	P exits and decrements fs->users.
      
      	T2 starts do_execve(), calls check_unsafe_exec(), now ->fs is not
      	shared, we set fs->in_exec.
      
      	T1 continues, open_exec(BAD_FILE) fails, we clear ->in_exec and
      	return to the user-space.
      
      	T1 does clone(CLONE_FS /* without CLONE_THREAD */).
      
      	T2 continues without LSM_UNSAFE_SHARE while ->fs is shared with
      	another process.
      
      Change check_unsafe_exec() to return res = 1 if we set ->in_exec, and change
      do_execve() to clear ->in_exec depending on res.
      
      When do_execve() suceeds, it is safe to clear ->in_exec unconditionally.
      It can be set only if we don't share ->fs with another process, and since
      we already killed all sub-threads either ->in_exec == 0 or we are the
      only user of this ->fs.
      
      Also, we do not need fs->lock to clear fs->in_exec.
      Signed-off-by: NOleg Nesterov <oleg@redhat.com>
      Acked-by: NRoland McGrath <roland@redhat.com>
      Acked-by: NHugh Dickins <hugh@veritas.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      8c652f96
  2. 22 4月, 2009 35 次提交
  3. 21 4月, 2009 3 次提交