diff options
| author | Oleg Nesterov <oleg@redhat.com> | 2017-08-21 17:35:02 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-08-24 17:00:10 -0700 |
| commit | 63407c4d1f9f64015974206e9bf40b318fdd74ee (patch) | |
| tree | 101c14cd7d1d1fd8916827412b9ec869ceb1abe9 /kernel | |
| parent | 8cf95002f0c9afe06fa1e4b9ebb0e10a77c481b1 (diff) | |
| download | linux-stable-63407c4d1f9f64015974206e9bf40b318fdd74ee.tar.gz linux-stable-63407c4d1f9f64015974206e9bf40b318fdd74ee.tar.bz2 linux-stable-63407c4d1f9f64015974206e9bf40b318fdd74ee.zip | |
pids: make task_tgid_nr_ns() safe
commit dd1c1f2f2028a7b851f701fc6a8ebe39dcb95e7c upstream.
This was reported many times, and this was even mentioned in commit
52ee2dfdd4f5 ("pids: refactor vnr/nr_ns helpers to make them safe") but
somehow nobody bothered to fix the obvious problem: task_tgid_nr_ns() is
not safe because task->group_leader points to nowhere after the exiting
task passes exit_notify(), rcu_read_lock() can not help.
We really need to change __unhash_process() to nullify group_leader,
parent, and real_parent, but this needs some cleanups. Until then we
can turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and
fix the problem.
Reported-by: Troy Kensinger <tkensinger@google.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/pid.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/kernel/pid.c b/kernel/pid.c index 82430c858d69..65a386e24811 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -523,8 +523,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, if (!ns) ns = task_active_pid_ns(current); if (likely(pid_alive(task))) { - if (type != PIDTYPE_PID) + if (type != PIDTYPE_PID) { + if (type == __PIDTYPE_TGID) + type = PIDTYPE_PID; task = task->group_leader; + } nr = pid_nr_ns(task->pids[type].pid, ns); } rcu_read_unlock(); @@ -533,12 +536,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, } EXPORT_SYMBOL(__task_pid_nr_ns); -pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns) -{ - return pid_nr_ns(task_tgid(tsk), ns); -} -EXPORT_SYMBOL(task_tgid_nr_ns); - struct pid_namespace *task_active_pid_ns(struct task_struct *tsk) { return ns_of_pid(task_pid(tsk)); |