aboutsummaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorDarrick J. Wong <djwong@us.ibm.com>2007-05-08 00:25:47 -0700
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-05-08 11:15:02 -0700
commit59cd0cbc75367b82f704f63b104117462275060d (patch)
tree695c4f7af4cf840a7e22e7767e1b5705e0b6d8d1 /fs
parent7695650a924a6859910c8c19dfa43b4d08224d66 (diff)
Fix race between proc_readdir and remove_proc_entry
Fix the following race: proc_readdir remove_proc_entry ============ ================= spin_lock(&proc_subdir_lock); [choose PDE to start filldir from] spin_unlock(&proc_subdir_lock); spin_lock(&proc_subdir_lock); [find PDE] [free PDE, refcount is 0] spin_unlock(&proc_subdir_lock); /* boom */ if (filldir(dirent, de->name, ... [de_put on error path --adobriyan] Signed-off-by: Darrick J. Wong <djwong@us.ibm.com> Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/proc/generic.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 22a08ff3475..8a40e15f5ec 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -478,14 +478,21 @@ int proc_readdir(struct file * filp,
}
do {
+ struct proc_dir_entry *next;
+
/* filldir passes info to user space */
+ de_get(de);
spin_unlock(&proc_subdir_lock);
if (filldir(dirent, de->name, de->namelen, filp->f_pos,
- de->low_ino, de->mode >> 12) < 0)
+ de->low_ino, de->mode >> 12) < 0) {
+ de_put(de);
goto out;
+ }
spin_lock(&proc_subdir_lock);
filp->f_pos++;
- de = de->next;
+ next = de->next;
+ de_put(de);
+ de = next;
} while (de);
spin_unlock(&proc_subdir_lock);
}