diff options
| author | Oleg Nesterov <oleg@tv-sign.ru> | 2006-06-15 20:11:43 +0400 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2006-06-20 01:54:53 -0700 |
| commit | 0ba239cc0ef0ebf9d38cd733754fcf657ae79b2b (patch) | |
| tree | 4c1f0987b6c29f8fd26f0f3ab92c1d3c5dc9ba6e /kernel/exit.c | |
| parent | 5705264e83bd9f8918895d8f5ddddbdeb062c719 (diff) | |
[PATCH] run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445)
do_exit() clears ->it_##clock##_expires, but nothing prevents
another cpu to attach the timer to exiting process after that.
arm_timer() tries to protect against this race, but the check
is racy.
After exit_notify() does 'write_unlock_irq(&tasklist_lock)' and
before do_exit() calls 'schedule() local timer interrupt can find
tsk->exit_state != 0. If that state was EXIT_DEAD (or another cpu
does sys_wait4) interrupted task has ->signal == NULL.
At this moment exiting task has no pending cpu timers, they were
cleanuped in __exit_signal()->posix_cpu_timers_exit{,_group}(),
so we can just return from irq.
John Stultz recently confirmed this bug, see
http://marc.theaimsgroup.com/?l=linux-kernel&m=115015841413687
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'kernel/exit.c')
| -rw-r--r-- | kernel/exit.c | 8 |
1 files changed, 0 insertions, 8 deletions
diff --git a/kernel/exit.c b/kernel/exit.c index 531aadca5530..fc46c9a86d2b 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -828,14 +828,6 @@ fastcall NORET_TYPE void do_exit(long code) tsk->flags |= PF_EXITING; - /* - * Make sure we don't try to process any timer firings - * while we are already exiting. - */ - tsk->it_virt_expires = cputime_zero; - tsk->it_prof_expires = cputime_zero; - tsk->it_sched_expires = 0; - if (unlikely(in_atomic())) printk(KERN_INFO "note: %s[%d] exited with preempt_count %d\n", current->comm, current->pid, |