Re: [PATCH] max_fds race in select().

From: Alexander Viro (viro@math.psu.edu)
Date: Thu May 03 2001 - 23:10:17 EST


On Fri, 4 May 2001, Rusty Russell wrote:

> We can end up with the user getting more fds tban they asked for...
>
> Unlikely, but possible,

True. If n is originally greater than ->max_fdset and ->max_fdset
grows between the comparison and assignment. Yuck.

Linus, please apply it - race is narrow, but...
                                                                Al

> --- linux-2.4.4-official/fs/select.c Thu Feb 22 14:25:36 2001
> +++ working-2.4.4-rcu/fs/select.c Fri May 4 14:06:39 2001
> @@ -260,7 +260,7 @@
> fd_set_bits fds;
> char *bits;
> long timeout;
> - int ret, size;
> + int ret, size, max_fdset;
>
> timeout = MAX_SCHEDULE_TIMEOUT;
> if (tvp) {
> @@ -285,8 +285,10 @@
> if (n < 0)
> goto out_nofds;
>
> - if (n > current->files->max_fdset)
> - n = current->files->max_fdset;
> + /* max_fdset can increase, so grab it once to avoid race */
> + max_fdset = current->files->max_fdset;
> + if (n > max_fdset)
> + n = max_fdset;
>
> /*
> * We need 6 bitmaps (in/out/ex for both incoming and outgoing),
>
> --
> Premature optmztion is rt of all evl. --DK
>

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Mon May 07 2001 - 21:00:19 EST