Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

BACKPORT: FROMLIST: pids: make task_tgid_nr_ns() safe

Browse source 
This was reported many times, and this was even mentioned in commit
52ee2dfdd4 "pids: refactor vnr/nr_ns helpers to make them safe" but
somehow nobody bothered to fix the obvious problem: task_tgid_nr_ns()
is not safe because task->group_leader points to nowhere after the
exiting task passes exit_notify(), rcu_read_lock() can not help.

We really need to change __unhash_process() to nullify group_leader,
parent, and real_parent, but this needs some cleanups. Until then we
can turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and
fix the problem.

Reported-by: Troy Kensinger <tkensinger@google.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>

(url: https://patchwork.kernel.org/patch/9913055/)
Bug: 31495866

Change-Id: I5e67b02a77e805f71fa3a787249f13c1310f02e2
This commit is contained in:
Oleg Nesterov 2017-08-21 17:35:02 +02:00 committed by Artem Borisov
parent 05f374ad9e
commit 4d448bba95
3 changed files with 17 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/linux/pid.h
View file

@ -8,7 +8,9 @@ enum pid_type
PIDTYPE_PID, PIDTYPE_PID,
PIDTYPE_PGID, PIDTYPE_PGID,
PIDTYPE_SID, PIDTYPE_SID,
PIDTYPE_MAX PIDTYPE_MAX,
/* only valid to __task_pid_nr_ns() */
__PIDTYPE_TGID
}; };
/* /*

17
include/linux/sched.h
View file

@ -1741,13 +1741,6 @@ static inline pid_t task_tgid_nr(struct task_struct *tsk)
return tsk->tgid; return tsk->tgid;
} }
pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns);
static inline pid_t task_tgid_vnr(struct task_struct *tsk)
{
return pid_vnr(task_tgid(tsk));
}
static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk, static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk,
struct pid_namespace *ns) struct pid_namespace *ns)
@ -1772,6 +1765,16 @@ static inline pid_t task_session_vnr(struct task_struct *tsk)
return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL); return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL);
} }
static inline pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
{
return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, ns);
}
static inline pid_t task_tgid_vnr(struct task_struct *tsk)
{
return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL);
}
/* obsolete, do not use */ /* obsolete, do not use */
static inline pid_t task_pgrp_nr(struct task_struct *tsk) static inline pid_t task_pgrp_nr(struct task_struct *tsk)
{ {

11
kernel/pid.c
View file

@ -496,8 +496,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
if (!ns) if (!ns)
ns = current->nsproxy->pid_ns; ns = current->nsproxy->pid_ns;
if (likely(pid_alive(task))) { if (likely(pid_alive(task))) {
if (type != PIDTYPE_PID) if (type != PIDTYPE_PID) {
if (type == __PIDTYPE_TGID)
type = PIDTYPE_PID;
task = task->group_leader; task = task->group_leader;
}
nr = pid_nr_ns(task->pids[type].pid, ns); nr = pid_nr_ns(task->pids[type].pid, ns);
} }
rcu_read_unlock(); rcu_read_unlock();
@ -506,12 +509,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
} }
EXPORT_SYMBOL(__task_pid_nr_ns); EXPORT_SYMBOL(__task_pid_nr_ns);
pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
{
return pid_nr_ns(task_tgid(tsk), ns);
}
EXPORT_SYMBOL(task_tgid_nr_ns);
struct pid_namespace *task_active_pid_ns(struct task_struct *tsk) struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)
{ {
return ns_of_pid(task_pid(tsk)); return ns_of_pid(task_pid(tsk));