David Howells
de09a9771a
CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials ...
It's possible for get_task_cred() as it currently stands to 'corrupt' a set of
credentials by incrementing their usage count after their replacement by the
task being accessed.
What happens is that get_task_cred() can race with commit_creds():
TASK_1 TASK_2 RCU_CLEANER
-->get_task_cred(TASK_2)
rcu_read_lock()
__cred = __task_cred(TASK_2)
-->commit_creds()
old_cred = TASK_2->real_cred
TASK_2->real_cred = ...
put_cred(old_cred)
call_rcu(old_cred)
[__cred->usage == 0]
get_cred(__cred)
[__cred->usage == 1]
rcu_read_unlock()
-->put_cred_rcu()
[__cred->usage == 1]
panic()
However, since a tasks credentials are generally not changed very often, we can
reasonably make use of a loop involving reading the creds pointer and using
atomic_inc_not_zero() to attempt to increment it if it hasn't already hit zero.
If successful, we can safely return the credentials in the knowledge that, even
if the task we're accessing has released them, they haven't gone to the RCU
cleanup code.
We then change task_state() in procfs to use get_task_cred() rather than
calling get_cred() on the result of __task_cred(), as that suffers from the
same problem.
Without this change, a BUG_ON in __put_cred() or in put_cred_rcu() can be
tripped when it is noticed that the usage count is not zero as it ought to be,
for example:
kernel BUG at kernel/cred.c:168!
invalid opcode: 0000 [#1 ] SMP
last sysfs file: /sys/kernel/mm/ksm/run
CPU 0
Pid: 2436, comm: master Not tainted 2.6.33.3-85.fc13.x86_64 #1 0HR330/OptiPlex
745
RIP: 0010:[<ffffffff81069881>] [<ffffffff81069881>] __put_cred+0xc/0x45
RSP: 0018:ffff88019e7e9eb8 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff880161514480 RCX: 00000000ffffffff
RDX: 00000000ffffffff RSI: ffff880140c690c0 RDI: ffff880140c690c0
RBP: ffff88019e7e9eb8 R08: 00000000000000d0 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000040 R12: ffff880140c690c0
R13: ffff88019e77aea0 R14: 00007fff336b0a5c R15: 0000000000000001
FS: 00007f12f50d97c0(0000) GS:ffff880007400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f461bc000 CR3: 00000001b26ce000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process master (pid: 2436, threadinfo ffff88019e7e8000, task ffff88019e77aea0)
Stack:
ffff88019e7e9ec8 ffffffff810698cd ffff88019e7e9ef8 ffffffff81069b45
<0> ffff880161514180 ffff880161514480 ffff880161514180 0000000000000000
<0> ffff88019e7e9f28 ffffffff8106aace 0000000000000001 0000000000000246
Call Trace:
[<ffffffff810698cd>] put_cred+0x13/0x15
[<ffffffff81069b45>] commit_creds+0x16b/0x175
[<ffffffff8106aace>] set_current_groups+0x47/0x4e
[<ffffffff8106ac89>] sys_setgroups+0xf6/0x105
[<ffffffff81009b02>] system_call_fastpath+0x16/0x1b
Code: 48 8d 71 ff e8 7e 4e 15 00 85 c0 78 0b 8b 75 ec 48 89 df e8 ef 4a 15 00
48 83 c4 18 5b c9 c3 55 8b 07 8b 07 48 89 e5 85 c0 74 04 <0f> 0b eb fe 65 48 8b
04 25 00 cc 00 00 48 3b b8 58 04 00 00 75
RIP [<ffffffff81069881>] __put_cred+0xc/0x45
RSP <ffff88019e7e9eb8>
---[ end trace df391256a100ebdd ]---
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-07-29 15:16:17 -07:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx
2010-05-30 09:12:43 -07:00
Revert "endian: #define __BYTE_ORDER"
2010-05-26 08:30:15 -07:00
can: sja1000 platform data fixes
2010-05-17 22:39:48 -07:00
Revert "V4L/DVB: Add FE_CAN_PSK_8 to allow apps to identify PSK_8 capable DVB devices"
2010-05-19 12:57:48 -03:00
Merge branch 'for-linus' of git://git.o-hand.com/linux-rpurdie-backlight
2010-05-27 11:34:55 -07:00
input: Touchscreen driver for TPS6507x
2010-05-28 01:37:38 +02:00
mfd: New AB8500 driver
2010-05-28 01:38:00 +02:00
sh: add boot code to MMCIF driver header
2010-05-31 13:11:47 +09:00
mtd: nand: support alternate BB marker locations on MLC
2010-05-14 01:56:12 +01:00
netfilter: xtables: stackptr should be percpu
2010-05-31 16:41:35 +02:00
regulator: tps6507x: allow driver to use DEFDCDC{2,3}_HIGH register
2010-07-28 15:09:26 +01:00
Merge remote branch 'origin' into secretlab/next-spi
2010-05-25 00:38:26 -06:00
SUNRPC: Don't spam gssd with upcall requests when the kerberos key expired
2010-05-14 15:09:37 -04:00
ALSA: usb-audio: unify constants from specification
2010-05-31 18:17:22 +02:00
ACPI / Sleep: Allow the NVS saving to be skipped during suspend to RAM
2010-07-24 23:26:09 -04:00
agp: drop vmalloc flag.
2010-06-15 09:56:01 +10:00
ahci: Add platform driver
2010-05-14 17:08:01 -04:00
aio: fix the compat vectored operations
2010-05-27 09:12:53 -07:00
serial: Add driver for the Altera JTAG UART
2010-05-21 09:34:30 -07:00
serial: Add driver for the Altera UART
2010-05-21 09:34:30 -07:00
libata-sff: prd is BMDMA specific
2010-05-19 13:38:54 -04:00
writeback: simplify the write back thread queue
2010-07-06 08:59:53 +02:00
Revert "cpusets: randomize node rotor used in cpuset_mem_spread_node()"
2010-05-30 09:00:03 -07:00
Merge branch 'core-hweight-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-05-18 09:17:01 -07:00
block: disable preemption before using sched_clock()
2010-06-01 12:23:18 +02:00
fs: introduce new truncate sequence
2010-05-27 22:15:33 -04:00
sched: Fix PROVE_RCU vs cpu_cgroup
2010-06-08 18:44:04 +02:00
mm: compaction: defer compaction using an exponential backoff when compaction fails
2010-05-25 08:07:00 -07:00
compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev
2010-05-27 09:12:53 -07:00
compiler-gcc.h: gcc-4.5 needs noclone and noinline on __naked functions
2010-06-29 15:29:31 -07:00
compiler-gcc.h: gcc-4.5 needs noclone and noinline on __naked functions
2010-06-29 15:29:31 -07:00
sched: add wait_for_completion_killable_timeout
2010-05-29 09:12:30 -07:00
ACPI, APEI, UEFI Common Platform Error Record (CPER) header
2010-05-19 22:41:05 -04:00
cpuidle: make cpuidle_curr_driver static
2010-05-27 21:06:58 -04:00
cpusets: new round-robin rotor for SLAB allocations
2010-05-27 09:12:44 -07:00
CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials
2010-07-29 15:16:17 -07:00
crypto: Use ARCH_KMALLOC_MINALIGN for CRYPTO_MINALIGN now that it's exposed
2010-05-19 22:03:14 +03:00
Fix the regression created by "set S_DEAD on unlink()..." commit
2010-05-15 07:16:33 -04:00
Add x64 support to debugfs
2010-05-19 22:41:57 -04:00
Merge remote branch 'origin' into secretlab/next-devicetree
2010-05-22 00:36:56 -06:00
dma-mapping: remove deprecated dma_sync_single and dma_sync_sg API
2010-05-27 09:12:53 -07:00
Merge branch 'ioat' into dmaengine
2010-05-17 16:30:58 -07:00
quota: unify ->set_dqblk
2010-05-21 19:30:44 +02:00
drbd: Fixed a race between disk-attach and unexpected state changes
2010-06-14 12:19:41 +02:00
drbd: Four new configuration settings for resync speed control
2010-05-18 01:25:00 +02:00
drbd: Four new configuration settings for resync speed control
2010-05-18 01:25:00 +02:00
module: initialize module dynamic debug later
2010-07-04 20:17:22 -07:00
[S390] add breaking event address for user space
2010-05-17 10:00:15 +02:00
linux/elfcore.h: hide kernel functions
2010-05-21 20:29:10 -07:00
err.h: add __must_check to error pointer handlers
2010-05-25 08:07:02 -07:00
ethtool: Fix potential user buffer overflow for ETHTOOL_{G, S}RXFH
2010-06-29 01:00:29 -07:00
ext2: Add ext2_sb_info s_lock spinlock
2010-05-21 19:30:39 +02:00
drop unused dentry argument to ->fsync
2010-05-27 22:05:02 -04:00
fb: handle allocation failure in alloc_apertures()
2010-07-20 15:24:09 +10:00
pipe: add support for shrinking and growing pipes
2010-05-21 21:12:40 +02:00
vfs: fix RCU-lockdep false positive due to /proc
2010-07-20 16:25:41 -07:00
fec: add support for PHY interface platform data
2010-05-24 00:36:13 -07:00
get rid of the magic around f_count in aio
2010-05-27 22:03:07 -04:00
firewire: core: use separate timeout for each transaction
2010-05-19 00:26:30 +02:00
firmware_class: fix memory leak - free allocated pages
2010-05-21 09:37:28 -07:00
VFS: introduce s_dirty accessors
2010-07-06 17:32:07 -07:00
Merge branch 'tracing-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-05-18 08:35:04 -07:00
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-05-27 15:23:47 -07:00
fuse: support splice() writing to fuse device
2010-05-25 15:06:06 +02:00
fs: xattr_handler table should be const
2010-05-21 18:31:18 -04:00
include/linux/gfp.h: fix coding style
2010-05-25 08:07:01 -07:00
gpiolib: introduce set_debounce method
2010-05-27 09:12:42 -07:00
tty: n_gsm line discipline
2010-05-21 09:34:29 -07:00
Merge branches 'upstream-fixes', 'bkl-removal', 'debugfs-fixes' and 'hid-suspend' into for-linus
2010-05-19 14:05:06 +02:00
highmem: remove unneeded #ifdef CONFIG_TRACE_IRQFLAGS_SUPPORT for debug_kmap_atomic()
2010-05-25 08:07:01 -07:00
i2c-omap: add mpu wake up latency constraint in i2c
2010-05-20 00:18:59 +01:00
Merge remote branch 'origin' into secretlab/next-devicetree
2010-05-22 00:36:56 -06:00
Input: i8042 - mark stubs in i8042.h "static inline"
2010-06-30 01:21:38 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6
2010-05-24 08:05:29 -07:00
net: Add netlink support for virtual port management (was iovnl)
2010-05-17 22:49:55 -07:00
macvtap: Limit packet queue length
2010-07-22 13:08:56 -07:00
Merge branch 'for-35' of git://repo.or.cz/linux-kbuild
2010-06-01 08:55:52 -07:00
Input: use ABS_CNT rather than (ABS_MAX + 1)
2010-05-20 23:05:28 -07:00
interrupt.h: fix fatal kernel-doc error
2010-05-21 10:48:12 -07:00
cfq-iosched: remove dead_key from cfq_io_context
2010-05-24 09:06:59 +02:00
resource: shared I/O region support
2010-05-11 12:01:10 -07:00
ipv6: ip6mr: support multiple tables
2010-05-11 14:40:55 +02:00
isapnp: move definitions to mod_devicetable.h so file2alias can reach them.
2010-05-19 17:33:38 +09:30
fbdev: move FBIO_WAITFORVSYNC to linux/fb.h
2010-05-25 08:07:09 -07:00
jbd: Provide function to check whether transaction will issue data barrier
2010-05-21 19:30:40 +02:00
jbd2/ocfs2: Fix block checksumming when a buffer is used in several transactions
2010-07-15 15:17:47 -07:00
Input: use ABS_CNT rather than (ABS_MAX + 1)
2010-05-20 23:05:28 -07:00
printk,kdb: capture printk() when in kdb shell
2010-05-20 21:04:27 -05:00
lib: introduce common method to convert hex digits
2010-05-25 08:07:05 -07:00
x86, kgdb, init: Add early and late debug states
2010-05-20 21:04:29 -05:00
umh: creds: kill subprocess_info->cred logic
2010-05-27 09:12:45 -07:00
netns: Teach network device kobjects which namespace they are in.
2010-05-21 09:37:32 -07:00
kref: remove kref_set
2010-05-21 09:37:29 -07:00
ktime: introduce ktime_to_ms()
2010-05-14 15:09:32 -04:00
KVM: PPC: Add OSI hypercall interface
2010-05-17 12:17:10 +03:00
KVM: Let vcpu structure alignment be determined at runtime
2010-05-19 11:36:29 +03:00
backlight: add S6E63M0 AMOLED LCD Panel driver
2010-05-26 17:34:16 +01:00
leds: leds-gpio: Change blink_set callback to be able to turn off blinking
2010-05-26 13:07:55 +01:00
libata: implement on-demand HPA unlocking
2010-06-02 13:50:10 -04:00
lis3: interrupt handlers for 8bit wakeup and click events
2010-05-25 08:07:07 -07:00
fs: fix superblock iteration race
2010-06-29 10:38:22 -07:00
lockdep: Add novalidate class for dev->mutex conversion
2010-05-21 09:37:30 -07:00
fbdev: move FBIO_WAITFORVSYNC to linux/fb.h
2010-05-25 08:07:09 -07:00
lmb: rename to memblock
2010-07-14 17:14:00 +10:00
memcg: fix mis-accounting of file mapped racy with migration
2010-05-27 09:12:44 -07:00
cpu/mem hotplug: enable CPUs online before local memory online
2010-05-25 08:07:00 -07:00
mempolicy: restructure rebinding-mempolicy functions
2010-05-25 08:06:57 -07:00
V4L/DVB: meye: remove last V4L1 remnants from the code and add v4l2_device
2010-05-18 00:52:36 -03:00
mm: compaction: memory compaction core
2010-05-25 08:06:59 -07:00
misc: Fix allocation 'borrowed' by vhost_net
2010-06-09 08:50:31 -07:00
mm: add context argument to shrinker callback
2010-07-19 14:56:17 +10:00
numa: introduce numa_mem_id()- effective local memory node id
2010-05-27 09:12:57 -07:00
Merge branch 'modules' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus
2010-05-21 17:15:44 -07:00
module: Make module sysfs functions private.
2010-06-05 11:17:36 +09:30
ipv6: ip6mr: support multiple tables
2010-05-11 14:40:55 +02:00
mv643xx_eth: use sw csum for big packets
2010-06-30 13:01:11 -07:00
ncpfs: BKL ioctl pushdown
2010-05-17 05:27:42 +02:00
linux/net.h: fix kernel-doc warnings
2010-07-02 21:59:08 -07:00
net: Fix definition of netif_vdbg() when VERBOSE_DEBUG is defined
2010-07-05 20:08:05 -07:00
netlink: Implment netlink_broadcast_filtered
2010-05-21 09:37:32 -07:00
NFS: Add helper functions for allocating filehandles and fattr structs
2010-05-14 15:09:21 -04:00
NFSv4: Clean up the NFSv4 setclientid operation
2010-05-14 15:09:30 -04:00
NFSv4: Clean up the NFSv4 setclientid operation
2010-05-14 15:09:30 -04:00
Revert "cpusets: randomize node rotor used in cpuset_mem_spread_node()"
2010-05-30 09:00:03 -07:00
notifier: change notifier_from_errno(0) to return NOTIFY_OK
2010-05-27 09:12:47 -07:00
of: change of_match_device to work with struct device
2010-05-22 00:10:41 -06:00
of: Remove duplicate fields from of_platform_driver
2010-05-22 00:10:40 -06:00
padata: Add some code comments
2010-05-19 13:44:27 +10:00
memcg: fix mis-accounting of file mapped racy with migration
2010-05-27 09:12:44 -07:00
PCI: fall back to original BIOS BAR addresses
2010-07-16 11:39:48 -07:00
ahci,ata_generic: let ata_generic handle new MBP w/ MCP89
2010-07-01 15:34:46 -04:00
Merge branch 'linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
2010-05-21 18:58:52 -07:00
Merge branch 'for-35' of git://repo.or.cz/linux-kbuild
2010-06-01 08:55:52 -07:00
perf_events: Fix races in group composition
2010-05-31 08:46:09 +02:00
sys_personality: change sys_personality() to accept "unsigned int" instead of u_long
2010-06-04 15:21:45 -07:00
pipe: change /proc/sys/fs/pipe-max-pages to byte sized interface
2010-06-03 14:54:39 +02:00
platform: Make platform resource input parameters const
2010-05-17 21:37:40 +02:00
power_supply: Add support for writeable properties
2010-05-19 12:14:42 +04:00
quota: Convert quota statistics to generic percpu_counter
2010-05-27 18:56:27 +02:00
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6
2010-05-30 09:11:11 -07:00
ramfs: replace inode uid,gid,mode initialization with helper function
2010-05-21 18:31:26 -04:00
lib/random32: export pseudo-random number generator for modules
2010-05-27 09:12:52 -07:00
ratelimit: add ratelimit_state_init()
2010-05-25 08:07:03 -07:00
rbtree: Undo augmented trees performance damage and regression
2010-07-05 14:43:50 +02:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-05-18 08:27:54 -07:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-05-18 08:27:54 -07:00
reiserfs: constify xattr_handler
2010-05-21 18:31:19 -04:00
reiserfs: constify xattr_handler
2010-05-21 18:31:19 -04:00
rapidio: fix new kernel-doc warnings
2010-05-30 09:02:47 -07:00
rapidio: add Port-Write handling for EM
2010-05-27 09:12:50 -07:00
rapidio: add IDT CPS/TSI switches
2010-05-27 09:12:50 -07:00
rapidio: add enabling SRIO port RX and TX
2010-05-27 09:12:51 -07:00
mm: migration: share the anon_vma ref counts between KSM and page migration
2010-05-25 08:06:58 -07:00
ipv6: ip6mr: support multiple tables
2010-05-11 14:40:55 +02:00
sched: Cure nr_iowait_cpu() users
2010-07-01 09:39:48 +02:00
sdhci-pltfm: implement platform data passing
2010-05-27 09:12:39 -07:00
ipc/sem.c: cacheline align the ipc spinlock for semaphores
2010-05-27 09:12:49 -07:00
Merge branch 'kdb-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb
2010-05-21 11:08:05 -07:00
serial: sh-sci: fix up serial DMA build.
2010-05-25 12:22:33 +09:00
SFI: add support for v0.81 spec
2010-05-25 11:41:43 -04:00
sh: fixup the docbook paths for clock framework shuffling.
2010-05-13 18:42:25 +09:00
net: deliver skbs on inactive slaves to exact matches
2010-06-10 22:23:34 -07:00
mm: Move ARCH_SLAB_MINALIGN and ARCH_KMALLOC_MINALIGN to <linux/slab_def.h>
2010-05-19 22:03:13 +03:00
mm: Move ARCH_SLAB_MINALIGN and ARCH_KMALLOC_MINALIGN to <linux/slob_def.h>
2010-05-19 22:03:13 +03:00
SLUB: Allow full duplication of kmalloc array for 390
2010-05-30 13:02:08 +03:00
Merge branch 'for-35' of git://repo.or.cz/linux-kbuild
2010-06-01 08:55:52 -07:00
pipe: add support for shrinking and growing pipes
2010-05-21 21:12:40 +02:00
suspend: Move NVS save/restore code to generic suspend functionality
2010-06-10 11:02:34 -04:00
memcg: move charge of file pages
2010-05-27 09:12:43 -07:00
swiotlb: remove unnecessary swiotlb_sync_single_range_*
2010-05-27 09:12:52 -07:00
tracing: Add alignment to syscall metadata declarations
2010-07-09 15:53:04 -04:00
sysctl: add proc_do_large_bitmap
2010-05-15 23:28:39 -07:00
sysfs: add struct file* to bin_attr callbacks
2010-05-21 09:37:31 -07:00
sysrq,kdb: Use __handle_sysrq() for kdb's sysrq function
2010-07-21 19:27:07 -05:00
KVM: VMX: enable VMXON check with SMX enabled (Intel TXT)
2010-05-19 11:36:34 +03:00
pids: increase pid_max based on num_possible_cpus
2010-05-27 09:12:51 -07:00
tipc: Update commenting in TIPC API
2010-05-12 23:02:23 -07:00
tipc: Add support for "-s" configuration option
2010-05-12 23:02:23 -07:00
numa: introduce numa_mem_id()- effective local memory node id
2010-05-27 09:12:57 -07:00
tracing: Fix undeclared ENOSYS in include/linux/tracepoint.h
2010-06-21 12:23:36 -04:00
tty: n_gsm line discipline
2010-05-21 09:34:29 -07:00
atomic_t: Remove volatile from atomic_t definition
2010-05-17 07:57:27 -07:00
Input: use ABS_CNT rather than (ABS_MAX + 1)
2010-05-20 23:05:28 -07:00
USB: remove unused usb_buffer_alloc and usb_buffer_free macros
2010-05-20 13:21:50 -07:00
Unified UUID/GUID definition
2010-05-19 22:40:47 -04:00
include/linux/vgaarb.h: add missing part of include guard
2010-07-21 09:51:15 +10:00
viafb: move some include files to include/linux
2010-05-11 16:07:59 -06:00
viafb: move some include files to include/linux
2010-05-11 16:07:59 -06:00
viafb: move some include files to include/linux
2010-05-11 16:07:59 -06:00
V4L/DVB: Add a new ERROR flag for DQBUF after recoverable streaming errors
2010-05-19 12:58:37 -03:00
virtio: add_buf_gfp
2010-05-19 22:15:46 +09:30
Add virtio disk identification support
2010-05-19 22:15:40 +09:30
virtio: console: Use a control message to add ports
2010-05-19 22:15:49 +09:30
mm: compaction: direct compact when a high-order allocation fails
2010-05-25 08:06:59 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6
2010-05-20 21:26:12 -07:00
writeback: split writeback_inodes_wb
2010-07-06 08:54:08 +02:00
fs: xattr_handler table should be const
2010-05-21 18:31:18 -04:00
m68k: amiga - Zorro host bridge platform device conversion
2010-05-17 21:37:42 +02:00
