diff options
| author | Davidlohr Bueso <dave@stgolabs.net> | 2021-12-10 10:20:58 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-12-14 14:49:02 +0100 |
| commit | 727858a98ac9061ca7159aa260e69f3cf8bca760 (patch) | |
| tree | 53d8f0af9fbf6c053e666799c144edf937e39122 | |
| parent | 9ba5635cfad7d58745dd739cfd8ac84111b0cad7 (diff) | |
| download | linux-stable-727858a98ac9061ca7159aa260e69f3cf8bca760.tar.gz linux-stable-727858a98ac9061ca7159aa260e69f3cf8bca760.tar.bz2 linux-stable-727858a98ac9061ca7159aa260e69f3cf8bca760.zip | |
block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream.
do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent
change_pid(PIDTYPE_PGID) that can move the task from one hlist
to another while iterating. Serialize ioprio_get to take
the tasklist_lock in this case, just like it's set counterpart.
Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}())
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | block/ioprio.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/block/ioprio.c b/block/ioprio.c index 77bcab11dce5..d70980d85c55 100644 --- a/block/ioprio.c +++ b/block/ioprio.c @@ -207,6 +207,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) pgrp = task_pgrp(current); else pgrp = find_vpid(who); + read_lock(&tasklist_lock); do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { tmpio = get_task_ioprio(p); if (tmpio < 0) @@ -216,6 +217,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) else ret = ioprio_best(ret, tmpio); } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); + read_unlock(&tasklist_lock); + break; case IOPRIO_WHO_USER: uid = make_kuid(current_user_ns(), who); |