Re: [Security] [vendor-sec] [BUG/PATCH/RFC] Oops while completing async USB via usbdevio

[Pete Zaitcev <zaitcev@redhat.com>]

On Thu, 13 Oct 2005 16:16:58 -0700 (PDT), Linus Torvalds <torvalds@osdl.org> wrote:

> "release()" won't be called until the _last_ close, and the task that 
> opened the fd can certainly exit before that.
>[...]
> It's a fundamental mistake to think that file descriptors stay with the 
> process that opened them. 

I am quite aware and my proposal takes it into account. I am sorry that
I failed to explain it adequately.

Did you even look at the pseudocode though?

-- Pete

P.S.
submit_urb()
   as->pid = current->pid;
   as->tgid = current->tgid;
.....
async_complete()
   __kill_same_process(as->pid, as->tgid);

/* DO NOT USE IN DRIVERS (other than USB core) */
__kill_same_process(pid_t pid, pid_t tgid) {
   task_struct *we, *maybe_parent;
   lock(&tasklist_lock);
   we = find_task_by_pid(pid);
   maybe_parent = find_task_by_tgid(pid);
   if (maybe_parent != NULL && we->parent == maybe_parent)
      send_sig_info(sig, info, we);
   unlock(&tasklist_lock);
}