commit 17568b1f31f7fa2c1fe9bbec467c40882502be79
Author: Erez Zadok <[EMAIL PROTECTED]>
Date: Tue Apr 15 13:25:45 2008 -0400
Unionfs: prevent races in unionfs_fault
vm_ops->fault may be called in parallel. Because we have to resort to
temporarily changing the vma->vm_file to point to the lower file, a
concurrent invocation of unionfs_fault could see a different value. In this
workaround, we keep a different copy of the vma structure in our stack, so
we never expose a different value of the vma->vm_file called to us, even
temporarily. A better fix (already tested) would be to change the calling
semantics of ->fault to take an explicit file pointer.
Signed-off-by: Erez Zadok <[EMAIL PROTECTED]>
diff --git a/fs/unionfs/mmap.c b/fs/unionfs/mmap.c
index 07db5b0..febde7c 100644
--- a/fs/unionfs/mmap.c
+++ b/fs/unionfs/mmap.c
@@ -40,23 +40,28 @@ static int unionfs_fault(struct vm_area_struct *vma, struct
vm_fault *vmf)
int err;
struct file *file, *lower_file;
struct vm_operations_struct *lower_vm_ops;
+ struct vm_area_struct lower_vma;
BUG_ON(!vma);
- file = vma->vm_file;
+ memcpy(&lower_vma, vma, sizeof(struct vm_area_struct));
+ file = lower_vma.vm_file;
lower_vm_ops = UNIONFS_F(file)->lower_vm_ops;
BUG_ON(!lower_vm_ops);
lower_file = unionfs_lower_file(file);
BUG_ON(!lower_file);
/*
- * XXX: we set the vm_file to the lower_file, before calling the
- * lower ->fault op, then we restore the vm_file back to the upper
- * file. Need to change the ->fault prototype to take an explicit
- * struct file, and fix all users accordingly.
+ * XXX: vm_ops->fault may be called in parallel. Because we have to
+ * resort to temporarily changing the vma->vm_file to point to the
+ * lower file, a concurrent invocation of unionfs_fault could see a
+ * different value. In this workaround, we keep a different copy of
+ * the vma structure in our stack, so we never expose a different
+ * value of the vma->vm_file called to us, even temporarily. A
+ * better fix would be to change the calling semantics of ->fault to
+ * take an explicit file pointer.
*/
- vma->vm_file = lower_file;
- err = lower_vm_ops->fault(vma, vmf);
- vma->vm_file = file;
+ lower_vma.vm_file = lower_file;
+ err = lower_vm_ops->fault(&lower_vma, vmf);
return err;
}
_______________________________________________
unionfs-cvs mailing list: http://unionfs.filesystems.org/
[email protected]
http://www.fsl.cs.sunysb.edu/mailman/listinfo/unionfs-cvs
