Messages in this thread | | | Date | Fri, 02 Aug 2002 11:48:15 -0700 | From | Dave Hansen <> | Subject | Re: [RFC] Race condition? |
| |
Oliver Neukum wrote: > Am Freitag, 2. August 2002 19:00 schrieb Dave Hansen: > >>Kasper Dupont wrote: >> >>>Is there a race condition in this piece of code from do_fork in >>>linux/kernel/fork.c? I cannot see what prevents two processes >>>from calling this at the same time and both successfully fork >>>even though the user had only one process left. >>> >>> if (atomic_read(&p->user->processes) >= >>>p->rlim[RLIMIT_NPROC].rlim_cur && !capable(CAP_SYS_ADMIN) && >>>!capable(CAP_SYS_RESOURCE)) goto bad_fork_free; >>> >>> atomic_inc(&p->user->__count); >>> atomic_inc(&p->user->processes); >> >>I don't see any locking in the call chain leading to this function, so >>I think you're right. The attached patch fixes this. It costs an >>extra 2 atomic ops in the failure case, but otherwise just makes the >>processes++ operation earlier. >> >>Patch is against 2.5.27, but applies against 30. > > It has the opposite failure mode. Forks only some of which should > succeed may all fail.
You beat me to it. I haven't had a chance to test it yet.
>>> if (atomic_read(&p->user->processes) >= >>>p->rlim[RLIMIT_NPROC].rlim_cur && !capable(CAP_SYS_ADMIN) && >>>!capable(CAP_SYS_RESOURCE)) goto bad_fork_free; -- Dave Hansen haveblue@us.ibm.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |