vfs: Fix possible chmod/truncate race condition.
PATCH 1/1 vfs: Fix possible chmod/truncate race condition.
Signed-off-by Dmitri Monakhov <[email protected]>
--- fs/open.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)
fs/open.c +1 -2
@@ -214,10 +214,9 @@ int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, newattrs.ia_valid |=ATTR_FILE ; } +mutex_lock (&dentry->d_inode->i_mutex);/* Remove suid/sgid on truncate too */ newattrs.ia_valid |=should_remove_suid (dentry); - -mutex_lock (&dentry->d_inode->i_mutex); err =notify_change (dentry, &newattrs);mutex_unlock (&dentry->d_inode->i_mutex);return err;
Signature · 1 line
1.5.4.3
Quoted 12 lines · On Wed, 15 Oct 2008 23:35:27 +0400 Dmitri Monakhov <[email protected]> wrote:
Signed-off-by Dmitri Monakhov <[email protected]>--- fs/open.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)fs/open.c +0
-0@@ -214,10 +214,9 @@ int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, newattrs.ia_valid |=ATTR_FILE ;
fs/open.c int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, · line 222
Quoted 10 lines
fs/open.c +1
-2} +mutex_lock (&dentry->d_inode->i_mutex);/* Remove suid/sgid on truncate too */ newattrs.ia_valid |=should_remove_suid (dentry); - -mutex_lock (&dentry->d_inode->i_mutex); err =notify_change (dentry, &newattrs);mutex_unlock (&dentry->d_inode->i_mutex);return err;
OK, I give up. What race?
Quoted 16 lines · Andrew Morton
Quoted 14 lines · On Wed, 15 Oct 2008 23:35:27 +0400 Dmitri Monakhov <[email protected]> wrote:
Signed-off-by Dmitri Monakhov <[email protected]>--- fs/open.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)fs/open.c +0
-0@@ -214,10 +214,9 @@ int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, newattrs.ia_valid |=ATTR_FILE ; }
Quoted 10 lines
fs/open.c int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, · line 222
Quoted 8 lines
fs/open.c +1
-2+mutex_lock (&dentry->d_inode->i_mutex);/* Remove suid/sgid on truncate too */ newattrs.ia_valid |=should_remove_suid (dentry); - -mutex_lock (&dentry->d_inode->i_mutex); err =notify_change (dentry, &newattrs);mutex_unlock (&dentry->d_inode->i_mutex);return err;OK, I give up. What race?
i_mode read not protected by i_mutex in should_remove_suid() and we may have race condition with chown(). Sorry, seems I've been too crazy about this. The truth is:
1: No one will call truncate() and chown() concurrently.
2: This race is still possible regardless to this fix.