rpms/kernel/F-11 fix-race-in-tty_fasync_properly.patch, NONE, 1.1.2.1 kernel.spec, 1.1784.2.22, 1.1784.2.23

[Chuck Ebbert]

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv13246

Modified Files:
      Tag: private-fedora-11-2_6_30
	kernel.spec 
Added Files:
      Tag: private-fedora-11-2_6_30
	fix-race-in-tty_fasync_properly.patch 
Log Message:
fix-race-in-tty_fasync_properly.patch: fix problems caused by the fix
  for bug #559100

fix-race-in-tty_fasync_properly.patch:
 drivers/char/tty_io.c |    4 +++-
 fs/fcntl.c            |    6 ++----
 2 files changed, 5 insertions(+), 5 deletions(-)

--- NEW FILE fix-race-in-tty_fasync_properly.patch ---
From: Linus Torvalds <torvalds at linux-foundation.org>
Date: Sun, 7 Feb 2010 18:11:23 +0000 (-0800)
Subject: Fix race in tty_fasync() properly
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=80e1e823989ec44d8e35bdfddadbddcffec90424

Fix race in tty_fasync() properly

[ backport to 2.6.30 ]

This reverts commit 703625118069 ("tty: fix race in tty_fasync") and
commit b04da8bfdfbb ("fnctl: f_modown should call write_lock_irqsave/
restore") that tried to fix up some of the fallout but was incomplete.

It turns out that we really cannot hold 'tty->ctrl_lock' over calling
__f_setown, because not only did that cause problems with interrupt
disables (which the second commit fixed), it also causes a potential
ABBA deadlock due to lock ordering.

Thanks to Tetsuo Handa for following up on the issue, and running
lockdep to show the problem.  It goes roughly like this:

 - f_getown gets filp->f_owner.lock for reading without interrupts
   disabled, so an interrupt that happens while that lock is held can
   cause a lockdep chain from f_owner.lock -> sighand->siglock.

 - at the same time, the tty->ctrl_lock -> f_owner.lock chain that
   commit 703625118069 introduced, together with the pre-existing
   sighand->siglock -> tty->ctrl_lock chain means that we have a lock
   dependency the other way too.

So instead of extending tty->ctrl_lock over the whole __f_setown() call,
we now just take a reference to the 'pid' structure while holding the
lock, and then release it after having done the __f_setown.  That still
guarantees that 'struct pid' won't go away from under us, which is all
we really ever needed.

Reported-and-tested-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
Acked-by: Greg Kroah-Hartman <gregkh at suse.de>
Acked-by: Américo Wang <xiyou.wangcong at gmail.com>
Cc: stable at kernel.org
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index c6f3b48..dcb9083 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1951,8 +1951,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
 			pid = task_pid(current);
 			type = PIDTYPE_PID;
 		}
-		retval = __f_setown(filp, pid, type, 0);
+		get_pid(pid);
 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+		retval = __f_setown(filp, pid, type, 0);
+		put_pid(pid);
 		if (retval)
 			goto out;
 	} else {
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 5ef953e..97e01dc 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -199,9 +199,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
                      uid_t uid, uid_t euid, int force)
 {
-	unsigned long flags;
-
-	write_lock_irqsave(&filp->f_owner.lock, flags);
+	write_lock_irq(&filp->f_owner.lock);
 	if (force || !filp->f_owner.pid) {
 		put_pid(filp->f_owner.pid);
 		filp->f_owner.pid = get_pid(pid);
@@ -213,7 +211,7 @@ static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
 		filp->f_owner.uid = uid;
 		filp->f_owner.euid = euid;
 	}
-	write_unlock_irqrestore(&filp->f_owner.lock, flags);
+	write_unlock_irq(&filp->f_owner.lock);
 }
 
 int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-11/kernel.spec,v
retrieving revision 1.1784.2.22
retrieving revision 1.1784.2.23
diff -u -p -r1.1784.2.22 -r1.1784.2.23
--- kernel.spec	9 Feb 2010 18:04:25 -0000	1.1784.2.22
+++ kernel.spec	11 Feb 2010 06:20:55 -0000	1.1784.2.23
@@ -876,6 +876,7 @@ Patch16514: linux-2.6-net-r8169-improved
 
 Patch16515: tty-fix-race-in-tty_fasync.patch
 Patch16516: fnctl-f_modown-should-call-write_lock_irqsave-restore.patch
+Patch16517: fix-race-in-tty_fasync_properly.patch
 
 # cve-2010-0291
 #Patch16520: untangle-the-do_mremap-mess.patch
@@ -1668,6 +1669,7 @@ ApplyPatch linux-2.6-net-r8169-improved-
 
 ApplyPatch tty-fix-race-in-tty_fasync.patch
 ApplyPatch fnctl-f_modown-should-call-write_lock_irqsave-restore.patch
+ApplyPatch fix-race-in-tty_fasync_properly.patch
 
 # cve-2010-0291
 #ApplyPatch untangle-the-do_mremap-mess.patch
@@ -2276,6 +2278,10 @@ fi
 # and build.
 
 %changelog
+* Thu Feb 11 2010 Chuck Ebbert <cebbert at redhat.com>  2.6.30.10-105.2.23
+- fix-race-in-tty_fasync_properly.patch: fix problems caused by the fix
+  for bug #559100
+
 * Tue Feb 09 2010 Chuck Ebbert <cebbert at redhat.com>  2.6.30.10-105.2.22
 - Fix the list of kernel symbols to search for when building the list
   of block devices (copied the list from the 2.6.32 kernel.)