• Al Viro's avatar
    fix misuses of f_count() in ppp and netlink · 24dff96a
    Al Viro authored
    we used to check for "nobody else could start doing anything with
    that opened file" by checking that refcount was 2 or less - one
    for descriptor table and one we'd acquired in fget() on the way to
    wherever we are.  That was race-prone (somebody else might have
    had a reference to descriptor table and do fget() just as we'd
    been checking) and it had become flat-out incorrect back when
    we switched to fget_light() on those codepaths - unlike fget(),
    it doesn't grab an extra reference unless the descriptor table
    is shared.  The same change allowed a race-free check, though -
    we are safe exactly when refcount is less than 2.
    
    It was a long time ago; pre-2.6.12 for ioctl() (the codepath leading
    to ppp one) and 2.6.17 for sendmsg() (netlink one).  OTOH,
    netlink hadn't grown that check until 3.9 and ppp used to live
    in drivers/net, not drivers/net/ppp until 3.1.  The bug existed
    well before that, though, and the same fix used to apply in old
    location of file.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    24dff96a
ppp_generic.c 70.9 KB