From: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
To: Neil Horman <nhorman@redhat.com>
Cc: linux-kernel@vger.kernel.org
Subject: Re: [Patch] vfs: increase scope of critical locked path in fget_light to avoid race
Date: Fri, 20 May 2005 14:33:38 +0100 [thread overview]
Message-ID: <20050520133337.GP29811@parcelfarce.linux.theplanet.co.uk> (raw)
In-Reply-To: <20050520132325.GE19229@hmsendeavour.rdu.redhat.com>
On Fri, May 20, 2005 at 09:23:25AM -0400, Neil Horman wrote:
> Patch to increase the scope of the locked critical path in fget_light to include
> the conditional where there is only one reference to the passed file_struct.
> Currently there is no protection against someone modifying that reference count
> after it has been read in fget_light and falling into a code path where the fd
> array is modified. The result is a race condition that leads to a corrupted fd
> table and potential oopses. This patch corrects that by enforcing the locking
> protocol that is used by all other accessors of the fd table on the 1 reference
> case in fget_light. Smoke tested by me, with no failures.
Er... If we get 1, we *KNOW* who holds the only reference - that's us.
And to change refcount of files_struct you need to hold a reference to
it.
Do you have a full race scenario? With all participants spelled out, please.
next prev parent reply other threads:[~2005-05-20 13:33 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-05-20 13:23 [Patch] vfs: increase scope of critical locked path in fget_light to avoid race Neil Horman
2005-05-20 13:33 ` Al Viro [this message]
2005-05-20 13:40 ` Al Viro
2005-05-20 15:25 ` Neil Horman
2005-05-20 21:28 ` Al Viro
2005-05-21 13:14 ` Neil Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050520133337.GP29811@parcelfarce.linux.theplanet.co.uk \
--to=viro@parcelfarce.linux.theplanet.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=nhorman@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.