linux-kernel - [PATCH] proc-remove-races-from-proc_id

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071120163457.GA13021@tv-sign.ru>
Date:	Tue, 20 Nov 2007 19:34:57 +0300
From:	Oleg Nesterov <oleg@...sign.ru>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Pavel Emelyanov <xemul@...nvz.org>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] proc-remove-races-from-proc_id_readdir-factor-out-tgid-increment

On 11/19, Eric W. Biederman wrote:
> 
> So to fix the problem this patch modifies next_tgid() to return
> both a tgid and the task struct in question.
> 
> A structure is introduced to return these values because it is
> slightly cleaner and easier to optimize, and the resulting code
> is a little shorter.

Nice. Perhaps we can also factor out the incrementing of iter.tgid? Lessens
the generated code, and (imho) cleanups the source a little bit.

(untested, 2.6.24-rc2-mm1 doesn't boot on my machine)

Signed-off-by: Oleg Nesterov <oleg@...sign.ru>

--- PT/fs/proc/base.c~	2007-11-20 19:00:05.000000000 +0300
+++ PT/fs/proc/base.c	2007-11-20 19:06:28.000000000 +0300
@@ -2378,6 +2378,7 @@ static struct tgid_iter next_tgid(struct
 	rcu_read_lock();
 retry:
 	iter.task = NULL;
+	iter.tgid++;
 	pid = find_ge_pid(iter.tgid, ns);
 	if (pid) {
 		iter.tgid = pid_nr_ns(pid, ns);
@@ -2394,10 +2395,8 @@ retry:
 		 * found doesn't happen to be a thread group leader.
 		 * As we don't care in the case of readdir.
 		 */
-		if (!iter.task || !has_group_leader_pid(iter.task)) {
-			iter.tgid += 1;
+		if (!iter.task || !has_group_leader_pid(iter.task))
 			goto retry;
-		}
 		get_task_struct(iter.task);
 	}
 	rcu_read_unlock();
@@ -2434,10 +2433,8 @@ int proc_pid_readdir(struct file * filp,
 
 	ns = filp->f_dentry->d_sb->s_fs_info;
 	iter.task = NULL;
-	iter.tgid = filp->f_pos - TGID_OFFSET;
-	for (iter = next_tgid(ns, iter);
-	     iter.task;
-	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
+	iter.tgid = filp->f_pos - TGID_OFFSET - 1;
+	while ((iter = next_tgid(ns, iter)).task) {
 		filp->f_pos = iter.tgid + TGID_OFFSET;
 		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
 			put_task_struct(iter.task);

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/