Unconditionally exchanging short filenames breaks userspace /proc/$$/exe links

Bug #1396907 reported by Stefan Bader
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Utopic
Fix Released
Undecided
Unassigned

Bug Description

SRU Justification:

Impact: Since v3.15 the link of /proc/<pid>/exe will unconditionally be renamed to the previous name of a binary when the filename is short and the binary was running. For example foo is a daemon and running while dpkg installs a new version. dpkg will unpack as foo.dpkg-new first and then rename to foo. After that /proc/<pid>/exe of the running foo daemon will point to the (no non-existent) foo.dpkg-new. Which in turn causes start-stop-daemon if that is used post-install to fail finding the running instance.

Fix: Backport of the following upstream change (which came with v3.17):
  From d2fa4a8476b911782f7e5167db18770222ac40c3 Mon Sep 17 00:00:00 2001
  From: Mikhail Efremov <email address hidden>
  Date: Wed, 24 Sep 2014 22:14:33 +0400
  Subject: [PATCH] vfs: Don't exchange "short" filenames unconditionally.

  Only exchange source and destination filenames
  if flags contain RENAME_EXCHANGE.
  In case if executable file was running and replaced by
  other file /proc/PID/exe should still show correct file name,
  not the old name of the file by which it was replaced.

Testcase: Any binary running that has a short (<= DNAME_INLINE_LEN) filename), copy the current binary to <oldname>.new and then move <oldname>.new to <oldname>. Now /proc/<pid>/exe of the running process points to <oldname>.new wihtout the change but remains to be <oldname> with the patch.

break-fix: da1ce0670c14d8380e423a3239e562a1dc15fa9e d2fa4a8476b911782f7e5167db18770222ac40c3
break-fix: da1ce0670c14d8380e423a3239e562a1dc15fa9e a28ddb87cdddb0db57466ba7f59f831002f4340c

Revision history for this message
Stefan Bader (smb) wrote :

Debian reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=763831 (did not use also-affects because that had weird effects last time I did that to another report).

Revision history for this message
Brad Figg (brad-figg) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1396907

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Changed in linux (Ubuntu Utopic):
status: New → Incomplete
Revision history for this message
Stefan Bader (smb) wrote : Re: Uncondicionally exchanging short filenames breaks userspace

It looks to make sense to follow Debian and also pick the following patch as it moves the following swap into switch_names at a position which will not be executed in the !exchange case:

* fold swapping ->d_name.hash into switch_names()

Stefan Bader (smb)
Changed in linux (Ubuntu):
status: Incomplete → Triaged
Changed in linux (Ubuntu Utopic):
status: Incomplete → Triaged
Andy Whitcroft (apw)
tags: added: kernel-bug-break-fix
Stefan Bader (smb)
description: updated
Andy Whitcroft (apw)
summary: - Uncondicionally exchanging short filenames breaks userspace
+ Unconditionally exchanging short filenames breaks userspace /proc/$$/exe
+ links
Stefan Bader (smb)
description: updated
Andy Whitcroft (apw)
Changed in linux (Ubuntu Utopic):
status: Triaged → Confirmed
Changed in linux (Ubuntu):
status: Triaged → Fix Committed
Andy Whitcroft (apw)
Changed in linux (Ubuntu):
status: Fix Committed → Fix Released
Andy Whitcroft (apw)
Changed in linux (Ubuntu Utopic):
status: Confirmed → Fix Committed
Andy Whitcroft (apw)
Changed in linux (Ubuntu Utopic):
status: Fix Committed → Fix Released
tags: removed: kernel-bug-break-fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.