summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@redhat.com>2009-04-24 01:01:56 +0200
committerLinus Torvalds <torvalds@linux-foundation.org>2009-04-24 07:39:45 -0700
commit8c652f96d3852b97a49c331cd0bb02d22f3cb31b (patch)
tree9752969f2ae7312026bb4037ecd950dafd403d9b /fs
parent091069740304c979f957ceacec39c461d0192158 (diff)
downloadkernel-crypto-8c652f96d3852b97a49c331cd0bb02d22f3cb31b.tar.gz
kernel-crypto-8c652f96d3852b97a49c331cd0bb02d22f3cb31b.tar.xz
kernel-crypto-8c652f96d3852b97a49c331cd0bb02d22f3cb31b.zip
do_execve() must not clear fs->in_exec if it was set by another thread
If do_execve() fails after check_unsafe_exec(), it clears fs->in_exec unconditionally. This is wrong if we race with our sub-thread which also does do_execve: Two threads T1 and T2 and another process P, all share the same ->fs. T1 starts do_execve(BAD_FILE). It calls check_unsafe_exec(), since ->fs is shared, we set LSM_UNSAFE but not ->in_exec. P exits and decrements fs->users. T2 starts do_execve(), calls check_unsafe_exec(), now ->fs is not shared, we set fs->in_exec. T1 continues, open_exec(BAD_FILE) fails, we clear ->in_exec and return to the user-space. T1 does clone(CLONE_FS /* without CLONE_THREAD */). T2 continues without LSM_UNSAFE_SHARE while ->fs is shared with another process. Change check_unsafe_exec() to return res = 1 if we set ->in_exec, and change do_execve() to clear ->in_exec depending on res. When do_execve() suceeds, it is safe to clear ->in_exec unconditionally. It can be set only if we don't share ->fs with another process, and since we already killed all sub-threads either ->in_exec == 0 or we are the only user of this ->fs. Also, we do not need fs->lock to clear fs->in_exec. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Roland McGrath <roland@redhat.com> Acked-by: Hugh Dickins <hugh@veritas.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/compat.c11
-rw-r--r--fs/exec.c19
2 files changed, 15 insertions, 15 deletions
diff --git a/fs/compat.c b/fs/compat.c
index 379a399bf5c..681ed81e6be 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1476,6 +1476,7 @@ int compat_do_execve(char * filename,
struct linux_binprm *bprm;
struct file *file;
struct files_struct *displaced;
+ bool clear_in_exec;
int retval;
retval = unshare_files(&displaced);
@@ -1498,8 +1499,9 @@ int compat_do_execve(char * filename,
goto out_unlock;
retval = check_unsafe_exec(bprm);
- if (retval)
+ if (retval < 0)
goto out_unlock;
+ clear_in_exec = retval;
file = open_exec(filename);
retval = PTR_ERR(file);
@@ -1546,9 +1548,7 @@ int compat_do_execve(char * filename,
goto out;
/* execve succeeded */
- write_lock(&current->fs->lock);
current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
current->in_execve = 0;
mutex_unlock(&current->cred_exec_mutex);
acct_update_integrals(current);
@@ -1568,9 +1568,8 @@ out_file:
}
out_unmark:
- write_lock(&current->fs->lock);
- current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
+ if (clear_in_exec)
+ current->fs->in_exec = 0;
out_unlock:
current->in_execve = 0;
diff --git a/fs/exec.c b/fs/exec.c
index 052a961e41a..a2e6989dbc3 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1077,9 +1077,11 @@ int check_unsafe_exec(struct linux_binprm *bprm)
if (p->fs->users > n_fs) {
bprm->unsafe |= LSM_UNSAFE_SHARE;
} else {
- if (p->fs->in_exec)
- res = -EAGAIN;
- p->fs->in_exec = 1;
+ res = -EAGAIN;
+ if (!p->fs->in_exec) {
+ p->fs->in_exec = 1;
+ res = 1;
+ }
}
unlock_task_sighand(p, &flags);
@@ -1284,6 +1286,7 @@ int do_execve(char * filename,
struct linux_binprm *bprm;
struct file *file;
struct files_struct *displaced;
+ bool clear_in_exec;
int retval;
retval = unshare_files(&displaced);
@@ -1306,8 +1309,9 @@ int do_execve(char * filename,
goto out_unlock;
retval = check_unsafe_exec(bprm);
- if (retval)
+ if (retval < 0)
goto out_unlock;
+ clear_in_exec = retval;
file = open_exec(filename);
retval = PTR_ERR(file);
@@ -1355,9 +1359,7 @@ int do_execve(char * filename,
goto out;
/* execve succeeded */
- write_lock(&current->fs->lock);
current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
current->in_execve = 0;
mutex_unlock(&current->cred_exec_mutex);
acct_update_integrals(current);
@@ -1377,9 +1379,8 @@ out_file:
}
out_unmark:
- write_lock(&current->fs->lock);
- current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
+ if (clear_in_exec)
+ current->fs->in_exec = 0;
out_unlock:
current->in_execve = 0;