tunnels: fix netns vs proto registration ordering

[safe/jmp/linux-2.6] / fs / exec.c

diff --git a/fs/exec.c b/fs/exec.c
index c0c636e..632b02e 100644 (file)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -826,7 +826,9 @@ static int de_thread(struct task_struct *tsk)
                attach_pid(tsk, PIDTYPE_PID,  task_pid(leader));
                transfer_pid(leader, tsk, PIDTYPE_PGID);
                transfer_pid(leader, tsk, PIDTYPE_SID);
+
                list_replace_rcu(&leader->tasks, &tsk->tasks);
+               list_replace_init(&leader->sibling, &tsk->sibling);
 
                tsk->group_leader = tsk;
                leader->group_leader = tsk;
@@ -923,6 +925,15 @@ char *get_task_comm(char *buf, struct task_struct *tsk)
 void set_task_comm(struct task_struct *tsk, char *buf)
 {
        task_lock(tsk);
+
+       /*
+        * Threads may access current->comm without holding
+        * the task lock, so write the string carefully.
+        * Readers without a lock may see incomplete new
+        * names but are safe from non-terminating string reads.
+        */
+       memset(tsk->comm, 0, TASK_COMM_LEN);
+       wmb();
        strlcpy(tsk->comm, buf, sizeof(tsk->comm));
        task_unlock(tsk);
        perf_event_comm(tsk);
@@ -1752,17 +1763,20 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
        struct mm_struct *mm = current->mm;
        struct linux_binfmt * binfmt;
        struct inode * inode;
-       struct file * file;
        const struct cred *old_cred;
        struct cred *cred;
        int retval = 0;
        int flag = 0;
        int ispipe = 0;
-       unsigned long core_limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
        char **helper_argv = NULL;
        int helper_argc = 0;
        int dump_count = 0;
        static atomic_t core_dump_count = ATOMIC_INIT(0);
+       struct coredump_params cprm = {
+               .signr = signr,
+               .regs = regs,
+               .limit = current->signal->rlim[RLIMIT_CORE].rlim_cur,
+       };
 
        audit_core_dumps(signr);
 
@@ -1818,15 +1832,15 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
        ispipe = format_corename(corename, signr);
        unlock_kernel();
 
-       if ((!ispipe) && (core_limit < binfmt->min_coredump))
+       if ((!ispipe) && (cprm.limit < binfmt->min_coredump))
                goto fail_unlock;
 
        if (ispipe) {
-               if (core_limit == 0) {
+               if (cprm.limit == 0) {
                        /*
                         * Normally core limits are irrelevant to pipes, since
                         * we're not writing to the file system, but we use
-                        * core_limit of 0 here as a speacial value. Any
+                        * cprm.limit of 0 here as a speacial value. Any
                         * non-zero limit gets set to RLIM_INFINITY below, but
                         * a limit of 0 skips the dump.  This is a consistent
                         * way to catch recursive crashes.  We can still crash
@@ -1859,25 +1873,25 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
                        goto fail_dropcount;
                }
 
-               core_limit = RLIM_INFINITY;
+               cprm.limit = RLIM_INFINITY;
 
                /* SIGPIPE can happen, but it's just never processed */
                if (call_usermodehelper_pipe(helper_argv[0], helper_argv, NULL,
-                               &file)) {
+                               &cprm.file)) {
                        printk(KERN_INFO "Core dump to %s pipe failed\n",
                               corename);
                        goto fail_dropcount;
                }
        } else
-               file = filp_open(corename,
+               cprm.file = filp_open(corename,
                                 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
                                 0600);
-       if (IS_ERR(file))
+       if (IS_ERR(cprm.file))
                goto fail_dropcount;
-       inode = file->f_path.dentry->d_inode;
+       inode = cprm.file->f_path.dentry->d_inode;
        if (inode->i_nlink > 1)
                goto close_fail;        /* multiple links - don't dump */
-       if (!ispipe && d_unhashed(file->f_path.dentry))
+       if (!ispipe && d_unhashed(cprm.file->f_path.dentry))
                goto close_fail;
 
        /* AK: actually i see no reason to not allow this for named pipes etc.,
@@ -1890,21 +1904,22 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
         */
        if (inode->i_uid != current_fsuid())
                goto close_fail;
-       if (!file->f_op)
+       if (!cprm.file->f_op)
                goto close_fail;
-       if (!file->f_op->write)
+       if (!cprm.file->f_op->write)
                goto close_fail;
-       if (!ispipe && do_truncate(file->f_path.dentry, 0, 0, file) != 0)
+       if (!ispipe &&
+           do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file) != 0)
                goto close_fail;
 
-       retval = binfmt->core_dump(signr, regs, file, core_limit);
+       retval = binfmt->core_dump(&cprm);
 
        if (retval)
                current->signal->group_exit_code |= 0x80;
 close_fail:
        if (ispipe && core_pipe_limit)
-               wait_for_dump_helpers(file);
-       filp_close(file, NULL);
+               wait_for_dump_helpers(cprm.file);
+       filp_close(cprm.file, NULL);
 fail_dropcount:
        if (dump_count)
                atomic_dec(&core_dump_count);