Oleg Nesterov <oleg@xxxxxxxxxx> writes:
> On 12/21, Oleg Nesterov wrote:
>>
>> Once again, the parent namespace injects the task T after ns->reaper
>> sees nr_hashed == 1 and returns. Suppose that reaper's parent does
>> do_wait() and free_pidmap() clears the bit == 1.
>>
>> Now, what if T doesn't exit but forks? We must not re-create the
>> task with pid_nr == 1 in the dead namespace. Normally this can't
>> happen, RESERVED_PIDS logic in alloc_pidmap() saves us. But it
>> seems that we need
>>
>> - .extra1 = &zero,
>> + .extra1 = &one,
>>
>> in pid_ns_ctl_table.
>
> Oh, and another problem, or I am totally confused.
>
> T forks and creates the child C1. C1 creates C2. What if C1 exits?
> It will try to reparent C2 to the dead/freed ns->child_reaper.
>
> In short. We shouldn't allow alloc_pid() if ns->child_reaper is dying,
> I think. nr_hashed == -1 doesn't really work.
Certainly nr_hashed == -1 is insufficient.
Injecting a processes when nr_hashed == 1 seems to be the magic poison.
I wonder if we could just say.
if (ns->nr_hashed == -1)
goto out_unlock;
if ((ns->nr_hashed >= 1) && (ns->child_reaper->flags & PF_EXITING))
goto out_unlock;
I don't know if the locking is sufficient at that point.
Eric
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
