The patch titled
introduce get_task_pid() to fix unsafe get_pid()
has been added to the -mm tree. Its filename is
introduce-get_task_pid-to-fix-unsafe-get_pid.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: introduce get_task_pid() to fix unsafe get_pid()
From: Oleg Nesterov <oleg@xxxxxxxxxx>
proc_pid_make_inode:
ei->pid = get_pid(task_pid(task));
I think this is not safe. get_pid() can be preempted after checking "pid
!= NULL". Then the task exits, does detach_pid(), and RCU frees the pid.
Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Cc: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
fs/proc/base.c | 4 ++--
include/linux/pid.h | 2 ++
kernel/pid.c | 9 +++++++++
3 files changed, 13 insertions(+), 2 deletions(-)
diff -puN fs/proc/base.c~introduce-get_task_pid-to-fix-unsafe-get_pid fs/proc/base.c
--- a/fs/proc/base.c~introduce-get_task_pid-to-fix-unsafe-get_pid
+++ a/fs/proc/base.c
@@ -958,7 +958,7 @@ static struct inode *proc_pid_make_inode
/*
* grab the reference to task.
*/
- ei->pid = get_pid(task_pid(task));
+ ei->pid = get_task_pid(task, PIDTYPE_PID);
if (!ei->pid)
goto out_unlock;
@@ -1677,7 +1677,7 @@ static struct dentry *proc_base_instanti
/*
* grab the reference to the task.
*/
- ei->pid = get_pid(task_pid(task));
+ ei->pid = get_task_pid(task, PIDTYPE_PID);
if (!ei->pid)
goto out_iput;
diff -puN include/linux/pid.h~introduce-get_task_pid-to-fix-unsafe-get_pid include/linux/pid.h
--- a/include/linux/pid.h~introduce-get_task_pid-to-fix-unsafe-get_pid
+++ a/include/linux/pid.h
@@ -68,6 +68,8 @@ extern struct task_struct *FASTCALL(pid_
extern struct task_struct *FASTCALL(get_pid_task(struct pid *pid,
enum pid_type));
+extern struct pid *get_task_pid(struct task_struct *task, enum pid_type type);
+
/*
* attach_pid() and detach_pid() must be called with the tasklist_lock
* write-held.
diff -puN kernel/pid.c~introduce-get_task_pid-to-fix-unsafe-get_pid kernel/pid.c
--- a/kernel/pid.c~introduce-get_task_pid-to-fix-unsafe-get_pid
+++ a/kernel/pid.c
@@ -304,6 +304,15 @@ struct task_struct *find_task_by_pid_typ
EXPORT_SYMBOL(find_task_by_pid_type);
+struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
+{
+ struct pid *pid;
+ rcu_read_lock();
+ pid = get_pid(task->pids[type].pid);
+ rcu_read_unlock();
+ return pid;
+}
+
struct task_struct *fastcall get_pid_task(struct pid *pid, enum pid_type type)
{
struct task_struct *result;
_
Patches currently in -mm which might be from oleg@xxxxxxxxxx are
rcu_do_batch-make-qlen-decrement-irq-safe.patch
git-block.patch
pid-implement-transfer_pid-and-use-it-to-simplify-de_thread.patch
pid-remove-temporary-debug-code-in-attach_pid.patch
rtmutex-clean-up-and-remove-some-extra-spinlocks.patch
rtmutex-clean-up-and-remove-some-extra-spinlocks-more.patch
elf_core_dump-dont-take-tasklist_lock.patch
elf_fdpic_core_dump-dont-take-tasklist_lock.patch
has_stopped_jobs-cleanup.patch
__dequeue_signal-cleanup.patch
do_sched_setscheduler-dont-take-tasklist_lock.patch
introduce-is_rt_policy-helper.patch
sched_setscheduler-fix-policy-checks.patch
reparent_to_init-use-has_rt_policy.patch
copy_process-cosmetic-ioprio-tweak.patch
futex_find_get_task-dont-take-tasklist_lock.patch
sys_get_robust_list-dont-take-tasklist_lock.patch
set-exit_dead-state-in-do_exit-not-in-schedule.patch
kill-pf_dead-flag.patch
introduce-task_dead-state.patch
select_bad_process-kill-a-bogus-pf_dead-task_dead-check.patch
select_bad_process-cleanup-releasing-check.patch
oom_kill_task-cleanup-mm-checks.patch
audit-accounting-tty-locking.patch
proc-readdir-race-fix-take-3-race-fix.patch
vt-rework-the-console-spawning-variables.patch
vt-make-vt_pid-a-struct-pid-making-it-pid-wrap-around-safe.patch
simplify-pid-iterators.patch
file-add-locking-to-f_getown.patch
proc-convert-task_sig-to-use-lock_task_sighand.patch
proc-convert-do_task_stat-to-use-lock_task_sighand.patch
proc-drop-tasklist-lock-in-task_state.patch
proc-properly-compute-tgid_offset.patch
proc-remove-trailing-blank-entry-from-pid_entry-arrays.patch
proc-remove-the-useless-smp-safe-comments-from-proc.patch
proc-comment-what-proc_fill_cache-does.patch
introduce-get_task_pid-to-fix-unsafe-get_pid.patch
rcu-simplify-improve-batch-tuning.patch
pidhash-temporary-debug-checks.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
