From: Eric Dumazet <edumazet@xxxxxxxxxx> On Mon, 2013-09-30 at 18:44 -0700, Linus Torvalds wrote: > Now, that only gets rid of fd_install(), but I suspect you could do > something similar for put_unused_fd() (that one does need cmpxchg for > the "next_fd" thing, though). We'd have to replace the non-atomic > bitops on open_fds[] with atomic ones, just to make sure adjacent bit > clearings don't screw up concurrent adjacent bit values, but that > looks fairly straightforward too. While looking at this (exciting) stuff, I found following bug. Maybe I am missing something obvious ? Thanks [PATCH] fs: fix a race in do_close_on_exec() commit 6a6d27de ("take close-on-exec logics to fs/file.c, clean it up a bit") added a possible race, as another thread could resize file table once we released files->file_lock. We must reload fdt after getting the lock. Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> --- fs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/file.c b/fs/file.c index 4a78f98..b614f13 100644 --- a/fs/file.c +++ b/fs/file.c @@ -616,10 +616,10 @@ void do_close_on_exec(struct files_struct *files) /* exec unshares first */ spin_lock(&files->file_lock); + fdt = files_fdtable(files); for (i = 0; ; i++) { unsigned long set; unsigned fd = i * BITS_PER_LONG; - fdt = files_fdtable(files); if (fd >= fdt->max_fds) break; set = fdt->close_on_exec[i]; @@ -639,6 +639,9 @@ void do_close_on_exec(struct files_struct *files) filp_close(file, files); cond_resched(); spin_lock(&files->file_lock); + + /* We released files->file_lock, we must reload fdt */ + fdt = files_fdtable(files); } } -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html