Skip to main content

Browse the archive

Staging
v0.5.1
https://github.com/torvalds/linux
02 December 2023, 22:23:51 UTC
Revision 45c18b0bb579b5c1b89f8c99f1b6ffa4c586ba08 authored by Linus Torvalds on 04 November 2006, 18:06:02 UTC, committed by Linus Torvalds on 04 November 2006, 18:06:02 UTC 
Fix unlikely (but possible) race condition on task->user access
 
There's a possible race condition when doing a "switch_uid()" from one
user to another, which could race with another thread doing a signal
allocation and looking at the old thread ->user pointer as it is freed.

This explains an oops reported by Lukasz Trabinski:
	http://permalink.gmane.org/gmane.linux.kernel/462241

We fix this by delaying the (reference-counted) freeing of the user
structure until the thread signal handler lock has been released, so
that we know that the signal allocation has either seen the new value or
has properly incremented the reference count of the old one.

Race identified by Oleg Nesterov.

Cc: Lukasz Trabinski <lukasz@wsisiz.edu.pl>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Andrew Morton <akpm@osdl.org>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1 parent 80491eb
History
Tip revision: 45c18b0bb579b5c1b89f8c99f1b6ffa4c586ba08 authored by Linus Torvalds on 04 November 2006, 18:06:02 UTC
Fix unlikely (but possible) race condition on task->user access
Tip revision: 45c18b0
File Mode Size
Documentation
arch
block
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
scripts
security
sound
usr
.gitignore -rw-r--r-- 542 bytes
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 88.2 KB
Kbuild -rw-r--r-- 1.2 KB
MAINTAINERS -rw-r--r-- 73.8 KB
Makefile -rw-r--r-- 49.0 KB
README -rw-r--r-- 16.2 KB
REPORTING-BUGS -rw-r--r-- 3.0 KB

README

back to top