diff options
| author | Andrew Morton <akpm@digeo.com> | 2003-02-10 07:37:12 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@home.transmeta.com> | 2003-02-10 07:37:12 -0800 |
| commit | b789ebfca657a1fc77f6bd4dd648c0d5e96057c8 (patch) | |
| tree | 96074583f732c733a6a62eabe48ca7f35203be98 /kernel/sys.c | |
| parent | 3322be329b2b75c784e0614aee71adc0dff2afdc (diff) | |
[PATCH] fix current->user->processes leak
Patch from: Eric Lammerts <eric@lammerts.org>
Every time you do a loop mount, a kernel thread is started (those
processes are called "loop0", "loop1", etc.). The problem is that when
it starts, it's counted as one of your processes. Then, it's
changed to be a root-owned process without correcting that count.
Patch below fixes the problem. It moves the bookkeeping of changing
current->user to a new function switch_uid() (which is now also used
by exec_usermodehelper() in kmod.c). The patch is tested.
Diffstat (limited to 'kernel/sys.c')
| -rw-r--r-- | kernel/sys.c | 13 |
1 files changed, 2 insertions, 11 deletions
diff --git a/kernel/sys.c b/kernel/sys.c index 9404304eba74..dffb67035c78 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -561,19 +561,12 @@ asmlinkage long sys_setgid(gid_t gid) static int set_user(uid_t new_ruid, int dumpclear) { - struct user_struct *new_user, *old_user; + struct user_struct *new_user; - /* What if a process setreuid()'s and this brings the - * new uid over his NPROC rlimit? We can check this now - * cheaply with the new uid cache, so if it matters - * we should be checking for it. -DaveM - */ new_user = alloc_uid(new_ruid); if (!new_user) return -EAGAIN; - old_user = current->user; - atomic_dec(&old_user->processes); - atomic_inc(&new_user->processes); + switch_uid(new_user); if(dumpclear) { @@ -581,8 +574,6 @@ static int set_user(uid_t new_ruid, int dumpclear) wmb(); } current->uid = new_ruid; - current->user = new_user; - free_uid(old_user); return 0; } |