Re: [PATCH 2/2] proc: fix PAGE_SIZE limit of /proc/$PID/cmdline

[Cyrill Gorcunov <gorcunov@gmail.com>]

On Thu, May 28, 2015 at 02:14:41PM +0300, Alexey Dobriyan wrote:
> >>
> >> It is snapshot w.r.t getting both pairs not snapshot w.r.t atomicity or
> >> something (unsigned long access is atomic after all). Once down_write()
> >> is used in the other place, it even becomes obviously correct code!
> >
> > Not at all. It is correct if and only if you're operating under lock
> > taken, once you fetch the pair and left the lock it simply local copies
> > of values the descriptor had when lock was taken.
> 
> Yes, and?
> 
> You do not complain that signal statistics is collected
> under sighand lock but printed for /proc/*/status without, do you?

They are different, in signal statistics we fetch the _complete_
entries, ie full copies of data. In turn you fetch only pointers
to data. Don't you see the difference? IOW, prctl modifies members
under the lock testing both the pointers and the data they points
to are valid _under_ the lock, but you instead fetch the addresses
under the lock, leave lock and continue operating with addresses,
which is wrong imho.

(I don't see some serious problem here because in worst scenario
 (if someone set up bad pointers here) we simply get page fault
 or some related error for application, not the kernel itself,
 so I won't insist).