On Fri, Nov 16, 2007 at 06:06:51PM +0300, Alexey Dobriyan wrote: > proc_kill_inodes() can clear ->i_fop in the middle of vfs_readdir resulting in > NULL dereference during "file->f_op->readdir(file, buf, filler)". > > The solution is to remove proc_kill_inodes() completely: > a) we don't have tricky modules implementing their tricky readdir hooks which > could keeping this revoke from hell. > b) In a situation when module is gone but PDE still alive, standard readdir > will return only "." and "..", because pde->next was cleared by > remove_proc_entry(). > c) the race proc_kill_inode() destined to prevent is not completely fixed, > just > race window made smaller, because vfs_readdir() is run without sb_lock > held and > without file_list_lock held. Effectively, ->i_fop is cleared at random > moment, > which can't fix properly anything.
Nice, getting rid of this is a very good step formwards. Unfortunately we have another copy of this junk in security/selinux/selinuxfs.c:sel_remove_entries() which would need the same treatment. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
