• Linus Torvalds's avatar
    Fix unlikely (but possible) race condition on task->user access · 45c18b0b
    Linus Torvalds authored
    There's a possible race condition when doing a "switch_uid()" from one
    user to another, which could race with another thread doing a signal
    allocation and looking at the old thread ->user pointer as it is freed.
    
    This explains an oops reported by Lukasz Trabinski:
    	http://permalink.gmane.org/gmane.linux.kernel/462241
    
    We fix this by delaying the (reference-counted) freeing of the user
    structure until the thread signal handler lock has been released, so
    that we know that the signal allocation has either seen the new value or
    has properly incremented the reference count of the old one.
    
    Race identified by Oleg Nesterov.
    
    Cc: Lukasz Trabinski <lukasz@wsisiz.edu.pl>
    Cc: Oleg Nesterov <oleg@tv-sign.ru>
    Cc: Andrew Morton <akpm@osdl.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    45c18b0b
user.c 5.39 KB