Messages in this thread | | | Subject | Re: [PATCH] vfs: Fix possible chmod/truncate race condition. | From | Dmitri Monakhov <> | Date | Mon, 27 Oct 2008 10:57:15 +0300 |
| |
Andrew Morton <akpm@linux-foundation.org> writes:
> On Wed, 15 Oct 2008 23:35:27 +0400 Dmitri Monakhov <dmonakhov@openvz.org> wrote: > >> >> Signed-off-by: Dmitri Monakhov <dmonakhov@openvz.org> >> --- >> fs/open.c | 3 +-- >> 1 files changed, 1 insertions(+), 2 deletions(-) >> >> diff --git a/fs/open.c b/fs/open.c >> index 07da935..3423b94 100644 >> --- a/fs/open.c >> +++ b/fs/open.c >> @@ -214,10 +214,9 @@ int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, >> newattrs.ia_valid |= ATTR_FILE; >> } >> >> + mutex_lock(&dentry->d_inode->i_mutex); >> /* Remove suid/sgid on truncate too */ >> newattrs.ia_valid |= should_remove_suid(dentry); >> - >> - mutex_lock(&dentry->d_inode->i_mutex); >> err = notify_change(dentry, &newattrs); >> mutex_unlock(&dentry->d_inode->i_mutex); >> return err; > > OK, I give up. What race? i_mode read not protected by i_mutex in should_remove_suid() and we may have race condition with chown(). Sorry, seems I've been too crazy about this. The truth is: 1: No one will call truncate() and chown() concurrently. 2: This race is still possible regardless to this fix.
| |