Commit 727858a9 authored Dec 10, 2021 by Davidlohr Bueso Committed by Greg Kroah-Hartman Dec 14, 2021

block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)



commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream.

do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent
change_pid(PIDTYPE_PGID) that can move the task from one hlist
to another while iterating. Serialize ioprio_get to take
the tasklist_lock in this case, just like it's set counterpart.

Fixes: d69b78ba (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}())
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net


Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 9ba5635c

block/ioprio.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -207,6 +207,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
		pgrp = task_pgrp(current);
		else
		pgrp = find_vpid(who);
		read_lock(&tasklist_lock);
		do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
		tmpio = get_task_ioprio(p);
		if (tmpio < 0)
		@@ -216,6 +217,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
		else
		ret = ioprio_best(ret, tmpio);
		} while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
		read_unlock(&tasklist_lock);

		break;
		case IOPRIO_WHO_USER:
		uid = make_kuid(current_user_ns(), who);