[PATCH] bsdacct: delete timer with sync intension

[PATCH] bsdacct: delete timer with sync intension

[Vitaliy Gusev]

acct_exit_ns --> acct_file_reopen deletes timer without
check timer execution on other CPUs. So acct_timeout() can
change an unmapped memory.

Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>

---
 kernel/acct.c |   17 +++++++++--------
 1 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/kernel/acct.c b/kernel/acct.c
index a6605ca..6ac80ca 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -353,17 +353,18 @@ restart:
 
 void acct_exit_ns(struct pid_namespace *ns)
 {
-	struct bsd_acct_struct *acct;
+	struct bsd_acct_struct *acct = ns->bacct;
 
-	spin_lock(&acct_lock);
-	acct = ns->bacct;
-	if (acct != NULL) {
-		if (acct->file != NULL)
-			acct_file_reopen(acct, NULL, NULL);
+	if (acct == NULL)
+		return;
 
-		kfree(acct);
-	}
+	del_timer_sync(&acct->timer);
+	spin_lock(&acct_lock);
+	if (acct->file != NULL)
+		acct_file_reopen(acct, NULL, NULL);
 	spin_unlock(&acct_lock);
+
+	kfree(acct);
 }
 
 /*

Re: [PATCH] bsdacct: delete timer with sync intension

[Andrew Morton]

On Thu, 25 Mar 2010 17:35:10 +0300
Vitaliy Gusev <vgusev@openvz.org> wrote:

> acct_exit_ns --> acct_file_reopen deletes timer without
> check timer execution on other CPUs. So acct_timeout() can
> change an unmapped memory.
> 

That sounds ugly.

> 
> ---
>  kernel/acct.c |   17 +++++++++--------
>  1 files changed, 9 insertions(+), 8 deletions(-)
> 
> diff --git a/kernel/acct.c b/kernel/acct.c
> index a6605ca..6ac80ca 100644
> --- a/kernel/acct.c
> +++ b/kernel/acct.c
> @@ -353,17 +353,18 @@ restart:
>  
>  void acct_exit_ns(struct pid_namespace *ns)
>  {
> -	struct bsd_acct_struct *acct;
> +	struct bsd_acct_struct *acct = ns->bacct;
>  
> -	spin_lock(&acct_lock);
> -	acct = ns->bacct;
> -	if (acct != NULL) {
> -		if (acct->file != NULL)
> -			acct_file_reopen(acct, NULL, NULL);
> +	if (acct == NULL)
> +		return;
>  
> -		kfree(acct);
> -	}
> +	del_timer_sync(&acct->timer);
> +	spin_lock(&acct_lock);
> +	if (acct->file != NULL)
> +		acct_file_reopen(acct, NULL, NULL);
>  	spin_unlock(&acct_lock);
> +
> +	kfree(acct);
>  }
>  

Is this sufficient?  acct_file_reopen() does a del_timer(), so
acct_timeout() could be running concurrently with acct_file_reopen(),
but acct_file_reopen() is merrily altering data at *acct.

Perhaps acct_file_reopen() should be using del_timer_sync()?



check_free_space() is doing a similar thing:

	        del_timer(&acct->timer);
	        acct->needcheck = 0;

the currently-running timer handler now goes and sets needcheck again!


Methinks the whole thing needs a bit of a rethink, bearing in mind how
del_timer() actually works.