Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

This project is archived. Its data is read-only.

Commit 1a657f78 authored Oct 02, 2006 by Oleg Nesterov Committed by Linus Torvalds Oct 02, 2006

[PATCH] introduce get_task_pid() to fix unsafe get_pid()



proc_pid_make_inode:

	ei->pid = get_pid(task_pid(task));

I think this is not safe.  get_pid() can be preempted after checking "pid
!= NULL".  Then the task exits, does detach_pid(), and RCU frees the pid.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

parent 1c0d04c9

fs/proc/base.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -958,7 +958,7 @@ static struct inode proc_pid_make_inode(struct super_block sb, struct task_st
		/*
		* grab the reference to task.
		*/
		ei->pid = get_pid(task_pid(task));
		ei->pid = get_task_pid(task, PIDTYPE_PID);
		if (!ei->pid)
		goto out_unlock;

		@@ -1677,7 +1677,7 @@ static struct dentry proc_base_instantiate(struct inode dir,
		/*
		* grab the reference to the task.
		*/
		ei->pid = get_pid(task_pid(task));
		ei->pid = get_task_pid(task, PIDTYPE_PID);
		if (!ei->pid)
		goto out_iput;

include/linux/pid.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -68,6 +68,8 @@ extern struct task_struct FASTCALL(pid_task(struct pid pid, enum pid_type));
		extern struct task_struct FASTCALL(get_pid_task(struct pid pid,
		enum pid_type));

		extern struct pid get_task_pid(struct task_struct task, enum pid_type type);

		/*
		* attach_pid() and detach_pid() must be called with the tasklist_lock
		* write-held.

kernel/pid.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -304,6 +304,15 @@ struct task_struct *find_task_by_pid_type(int type, int nr)

		EXPORT_SYMBOL(find_task_by_pid_type);

		struct pid get_task_pid(struct task_struct task, enum pid_type type)
		{
		struct pid *pid;
		rcu_read_lock();
		pid = get_pid(task->pids[type].pid);
		rcu_read_unlock();
		return pid;
		}

		struct task_struct fastcall get_pid_task(struct pid pid, enum pid_type type)
		{
		struct task_struct *result;