Linux 2.6.24.7

Linux 2.6.24.7

[Greg Kroah-Hartman]

We (the -stable team) are announcing the release of the 2.6.24.7 kernel.

Yeah, I said that there was not going to be anymore unless a security
issue happened, well, that's what happened.

This release fixes a security issue and all users of the 2.6.24 series
are strongly encouraged to upgrade.

I'll also be replying to this message with a copy of the patch between
2.6.24.6 and 2.6.24.7

The updated 2.6.24.y git tree can be found at:
        git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.24.y.git
and can be browsed at the normal kernel.org git web browser:
        http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.24.y.git;a=summary

thanks,

greg k-h

--------

 Makefile   |    2 +-
 fs/locks.c |   17 +++++++++++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)


Al Viro (1):
      fix SMP ordering hole in fcntl_setlk() (CVE-2008-1669)

Greg Kroah-Hartman (1):
      Linux 2.6.24.7

Re: Linux 2.6.24.7

[Greg Kroah-Hartman]

diff --git a/Makefile b/Makefile
index f619bbc..78ec132 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 24
-EXTRAVERSION = .6
+EXTRAVERSION = .7
 NAME = Err Metey! A Heury Beelge-a Ret!
 
 # *DOCUMENTATION*
diff --git a/fs/locks.c b/fs/locks.c
index 2fd29d9..7127620 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1754,6 +1754,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
 	struct file_lock *file_lock = locks_alloc_lock();
 	struct flock flock;
 	struct inode *inode;
+	struct file *f;
 	int error;
 
 	if (file_lock == NULL)
@@ -1826,7 +1827,15 @@ again:
 	 * Attempt to detect a close/fcntl race and recover by
 	 * releasing the lock that was just acquired.
 	 */
-	if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
+	/*
+	 * we need that spin_lock here - it prevents reordering between
+	 * update of inode->i_flock and check for it done in close().
+	 * rcu_read_lock() wouldn't do.
+	 */
+	spin_lock(&current->files->file_lock);
+	f = fcheck(fd);
+	spin_unlock(&current->files->file_lock);
+	if (!error && f != filp && flock.l_type != F_UNLCK) {
 		flock.l_type = F_UNLCK;
 		goto again;
 	}
@@ -1882,6 +1891,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
 	struct file_lock *file_lock = locks_alloc_lock();
 	struct flock64 flock;
 	struct inode *inode;
+	struct file *f;
 	int error;
 
 	if (file_lock == NULL)
@@ -1954,7 +1964,10 @@ again:
 	 * Attempt to detect a close/fcntl race and recover by
 	 * releasing the lock that was just acquired.
 	 */
-	if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
+	spin_lock(&current->files->file_lock);
+	f = fcheck(fd);
+	spin_unlock(&current->files->file_lock);
+	if (!error && f != filp && flock.l_type != F_UNLCK) {
 		flock.l_type = F_UNLCK;
 		goto again;
 	}