[patch 42/58] do_execve() must not clear fs->in_exec if it was set by another thread

Greg KH
2009-05-06T22:12:41Z

[-- Attachment #1: do_execve-must-not-clear-fs-in_exec-if-it-was-set-by-another-thread.patch --]
[-- Type: text/plain, Size: 4148 bytes --]

2.6.29-stable review patch. If anyone has any objections, please let us know.

------------------

From: Oleg Nesterov <oleg@redhat.com>

commit 8c652f96d3852b97a49c331cd0bb02d22f3cb31b upstream.

If do_execve() fails after check_unsafe_exec(), it clears fs->in_exec
unconditionally. This is wrong if we race with our sub-thread which
also does do_execve:

Two threads T1 and T2 and another process P, all share the same
->fs.

T1 starts do_execve(BAD_FILE). It calls check_unsafe_exec(), since
->fs is shared, we set LSM_UNSAFE but not ->in_exec.

P exits and decrements fs->users.

T2 starts do_execve(), calls check_unsafe_exec(), now ->fs is not
shared, we set fs->in_exec.

T1 continues, open_exec(BAD_FILE) fails, we clear ->in_exec and
return to the user-space.

T1 does clone(CLONE_FS /* without CLONE_THREAD */).

T2 continues without LSM_UNSAFE_SHARE while ->fs is shared with
another process.

Change check_unsafe_exec() to return res = 1 if we set ->in_exec, and change
do_execve() to clear ->in_exec depending on res.

When do_execve() suceeds, it is safe to clear ->in_exec unconditionally.
It can be set only if we don't share ->fs with another process, and since
we already killed all sub-threads either ->in_exec == 0 or we are the
only user of this ->fs.

Also, we do not need fs->lock to clear fs->in_exec.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@redhat.com>
Acked-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
fs/compat.c | 11 +++++------
fs/exec.c | 19 ++++++++++---------
2 files changed, 15 insertions(+), 15 deletions(-)

--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1394,6 +1394,7 @@ int compat_do_execve(char * filename,
struct linux_binprm *bprm;
struct file *file;
struct files_struct *displaced;
+ bool clear_in_exec;
int retval;

retval = unshare_files(&displaced);
@@ -1415,8 +1416,9 @@ int compat_do_execve(char * filename,
goto out_unlock;

retval = check_unsafe_exec(bprm);
- if (retval)
+ if (retval < 0)
goto out_unlock;
+ clear_in_exec = retval;

file = open_exec(filename);
retval = PTR_ERR(file);
@@ -1463,9 +1465,7 @@ int compat_do_execve(char * filename,
goto out;

/* execve succeeded */
- write_lock(&current->fs->lock);
current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
mutex_unlock(&current->cred_exec_mutex);
acct_update_integrals(current);
free_bprm(bprm);
@@ -1484,9 +1484,8 @@ out_file:
}

out_unmark:
- write_lock(&current->fs->lock);
- current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
+ if (clear_in_exec)
+ current->fs->in_exec = 0;

out_unlock:
mutex_unlock(&current->cred_exec_mutex);
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1069,9 +1069,11 @@ int check_unsafe_exec(struct linux_binpr
if (p->fs->users > n_fs) {
bprm->unsafe |= LSM_UNSAFE_SHARE;
} else {
- if (p->fs->in_exec)
- res = -EAGAIN;
- p->fs->in_exec = 1;
+ res = -EAGAIN;
+ if (!p->fs->in_exec) {
+ p->fs->in_exec = 1;
+ res = 1;
+ }
}

unlock_task_sighand(p, &flags);
@@ -1273,6 +1275,7 @@ int do_execve(char * filename,
struct linux_binprm *bprm;
struct file *file;
struct files_struct *displaced;
+ bool clear_in_exec;
int retval;

retval = unshare_files(&displaced);
@@ -1294,8 +1297,9 @@ int do_execve(char * filename,
goto out_unlock;

retval = check_unsafe_exec(bprm);
- if (retval)
+ if (retval < 0)
goto out_unlock;
+ clear_in_exec = retval;

file = open_exec(filename);
retval = PTR_ERR(file);
@@ -1343,9 +1347,7 @@ int do_execve(char * filename,
goto out;

/* execve succeeded */
- write_lock(&current->fs->lock);
current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
mutex_unlock(&current->cred_exec_mutex);
acct_update_integrals(current);
free_bprm(bprm);
@@ -1364,9 +1366,8 @@ out_file:
}

out_unmark:
- write_lock(&current->fs->lock);
- current->fs->in_exec = 0;
- write_unlock(&current->fs->lock);
+ if (clear_in_exec)
+ current->fs->in_exec = 0;

out_unlock:
mutex_unlock(&current->cred_exec_mutex);