Re: Q: check_unsafe_exec() races (Was: [PATCH 2/4] fix setuid sometimes doesn't)

Al Viro
2009-03-31T06:21:37Z

On Mon, Mar 30, 2009 at 06:45:39PM -0500, Serge E. Hallyn wrote:

> (note exactly *meaningful* review, but)
>
> exit_fs() and daemonize_fs_struct() do:
>
> if (--fs->users)
> fs = NULL;
> write_unlock(&fs->lock);
>
> Moving the write_unlock up actually let's the kernel boot and
> start running ltp.

Correct fix is
kill = !--fs->users;
write_unlock(&fs->lock);
...
if (kill)
free_fs_struct(fs);
and similar in other places with the same idiocy (one of which forgets to
unlock, on top of everything else).

Anyway, hopefully much saner (== looked through after getting some sleep,
as opposed to "what I've got in that branch at ~26 hours of uptime")
variant is in the same repository, same branch.