Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd1c1f2f authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

pids: make task_tgid_nr_ns() safe 



This was reported many times, and this was even mentioned in commit
52ee2dfd ("pids: refactor vnr/nr_ns helpers to make them safe") but
somehow nobody bothered to fix the obvious problem: task_tgid_nr_ns() is
not safe because task->group_leader points to nowhere after the exiting
task passes exit_notify(), rcu_read_lock() can not help.

We really need to change __unhash_process() to nullify group_leader,
parent, and real_parent, but this needs some cleanups.  Until then we
can turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and
fix the problem.

Reported-by: default avatarTroy Kensinger <tkensinger@google.com>
Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 14ccee78

include/linux/pid.h

+3 −1
Original line number Diff line number Diff line
@@ -8,7 +8,9 @@ enum pid_type 
	PIDTYPE_PID,

	PIDTYPE_PGID,

	PIDTYPE_SID,

	PIDTYPE_MAX

	PIDTYPE_MAX,

	/* only valid to __task_pid_nr_ns() */

	__PIDTYPE_TGID

};



/*

include/linux/sched.h

+27 −24
Original line number Diff line number Diff line
@@ -1163,13 +1163,6 @@ static inline pid_t task_tgid_nr(struct task_struct *tsk) 
	return tsk->tgid;

}



extern pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns);



static inline pid_t task_tgid_vnr(struct task_struct *tsk)

{

	return pid_vnr(task_tgid(tsk));

}



/**

 * pid_alive - check that a task structure is not stale

 * @p: Task structure to be checked.
@@ -1185,23 +1178,6 @@ static inline int pid_alive(const struct task_struct *p) 
	return p->pids[PIDTYPE_PID].pid != NULL;

}



static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)

{

	pid_t pid = 0;



	rcu_read_lock();

	if (pid_alive(tsk))

		pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);

	rcu_read_unlock();



	return pid;

}



static inline pid_t task_ppid_nr(const struct task_struct *tsk)

{

	return task_ppid_nr_ns(tsk, &init_pid_ns);

}



static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)

{

	return __task_pid_nr_ns(tsk, PIDTYPE_PGID, ns);
@@ -1223,6 +1199,33 @@ static inline pid_t task_session_vnr(struct task_struct *tsk) 
	return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL);

}



static inline pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)

{

	return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, ns);

}



static inline pid_t task_tgid_vnr(struct task_struct *tsk)

{

	return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL);

}



static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)

{

	pid_t pid = 0;



	rcu_read_lock();

	if (pid_alive(tsk))

		pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);

	rcu_read_unlock();



	return pid;

}



static inline pid_t task_ppid_nr(const struct task_struct *tsk)

{

	return task_ppid_nr_ns(tsk, &init_pid_ns);

}



/* Obsolete, do not use: */

static inline pid_t task_pgrp_nr(struct task_struct *tsk)

{

kernel/pid.c

+4 −7
Original line number Diff line number Diff line
@@ -527,8 +527,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, 
	if (!ns)

		ns = task_active_pid_ns(current);

	if (likely(pid_alive(task))) {

		if (type != PIDTYPE_PID)

		if (type != PIDTYPE_PID) {

			if (type == __PIDTYPE_TGID)

				type = PIDTYPE_PID;

			task = task->group_leader;

		}

		nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns);

	}

	rcu_read_unlock();
@@ -537,12 +540,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, 
}

EXPORT_SYMBOL(__task_pid_nr_ns);



pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)

{

	return pid_nr_ns(task_tgid(tsk), ns);

}

EXPORT_SYMBOL(task_tgid_nr_ns);



struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)

{

	return ns_of_pid(task_pid(tsk));