Fix race between proc_readdir and remove_proc_entry
authorDarrick J. Wong <djwong@us.ibm.com>
Tue, 8 May 2007 07:25:47 +0000 (00:25 -0700)
committerLinus Torvalds <torvalds@woody.linux-foundation.org>
Tue, 8 May 2007 18:15:02 +0000 (11:15 -0700)
Fix the following race:

proc_readdir remove_proc_entry
============ =================

spin_lock(&proc_subdir_lock);
[choose PDE to start filldir from]
spin_unlock(&proc_subdir_lock);
spin_lock(&proc_subdir_lock);
[find PDE]
[free PDE, refcount is 0]
spin_unlock(&proc_subdir_lock);
    /* boom */
if (filldir(dirent, de->name, ...

[de_put on error path --adobriyan]
Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/proc/generic.c

index 22a08ff3475de39b203806a55076cc02e8a13dfc..8a40e15f5ecb90333f7eca84ede39c40e7adb945 100644 (file)
@@ -478,14 +478,21 @@ int proc_readdir(struct file * filp,
                        }
 
                        do {
+                               struct proc_dir_entry *next;
+
                                /* filldir passes info to user space */
+                               de_get(de);
                                spin_unlock(&proc_subdir_lock);
                                if (filldir(dirent, de->name, de->namelen, filp->f_pos,
-                                           de->low_ino, de->mode >> 12) < 0)
+                                           de->low_ino, de->mode >> 12) < 0) {
+                                       de_put(de);
                                        goto out;
+                               }
                                spin_lock(&proc_subdir_lock);
                                filp->f_pos++;
-                               de = de->next;
+                               next = de->next;
+                               de_put(de);
+                               de = next;
                        } while (de);
                        spin_unlock(&proc_subdir_lock);
        }