Re: [Patch] vfs: increase scope of critical locked path in fget_light to avoid race

[Al Viro <viro@parcelfarce.linux.theplanet.co.uk>]

On Fri, May 20, 2005 at 09:23:25AM -0400, Neil Horman wrote:
> Patch to increase the scope of the locked critical path in fget_light to include
> the conditional where there is only one reference to the passed file_struct.
> Currently there is no protection against someone modifying that reference count
> after it has been read in fget_light and falling into a code path where the fd
> array is modified.  The result is a race condition that leads to a corrupted fd
> table and potential oopses.  This patch corrects that by enforcing the locking
> protocol that is used by all other accessors of the fd table on the 1 reference
> case in fget_light.  Smoke tested by me, with no failures.

Er...  If we get 1, we *KNOW* who holds the only reference - that's us.
And to change refcount of files_struct you need to hold a reference to
it.

Do you have a full race scenario?  With all participants spelled out, please.