Commit 84d535ad authored Sep 11, 2007 by Pavel Emelyanov Committed by J. Bruce Fields Oct 09, 2007

Memory shortage can result in inconsistent flocks state



When the flock_lock_file() is called to change the flock
from F_RDLCK to F_WRLCK or vice versa the existing flock
can be removed without appropriate warning.

Look:
        for_each_lock(inode, before) {
                struct file_lock *fl = *before;
                if (IS_POSIX(fl))
                        break;
                if (IS_LEASE(fl))
                        continue;
                if (filp != fl->fl_file)
                        continue;
                if (request->fl_type == fl->fl_type)
                        goto out;
                found = 1;
                locks_delete_lock(before); <<<<<< !
                break;
        }

if after this point the subsequent locks_alloc_lock() will
fail the return code will be -ENOMEM, but the existing lock
is already removed.

This is a known feature that such "re-locking" is not atomic,
but in the racy case the file should stay locked (although by
some other process), but in this case the file will be unlocked.

The proposal is to prepare the lock in advance keeping no chance
to fail in the future code.

Found during making the flocks pid-namespaces aware.

(Note: Thanks to Reuben Farrelly for finding a bug in an earlier version
of this patch.)

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Cc: Reuben Farrelly <reuben-linuxkernel@reub.net>

parent 526985b9

fs/locks.c

+9 −4

Original line number	Diff line number	Diff line
		@@ -733,6 +733,15 @@ static int flock_lock_file(struct file filp, struct file_lock request)
		lock_kernel();
		if (request->fl_flags & FL_ACCESS)
		goto find_conflict;

		if (request->fl_type != F_UNLCK) {
		error = -ENOMEM;
		new_fl = locks_alloc_lock();
		if (new_fl == NULL)
		goto out;
		error = 0;
		}

		for_each_lock(inode, before) {
		struct file_lock fl = before;
		if (IS_POSIX(fl))
		@@ -754,10 +763,6 @@ static int flock_lock_file(struct file filp, struct file_lock request)
		goto out;
		}

		error = -ENOMEM;
		new_fl = locks_alloc_lock();
		if (new_fl == NULL)
		goto out;
		/*
		* If a higher-priority process was blocked on the old file lock,
		* give it the opportunity to lock the file.

Admin message