Patch "fcntl: make F_GETOWN(EX) return 0 on dead owner task" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    fcntl: make F_GETOWN(EX) return 0 on dead owner task

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fcntl-make-f_getown-ex-return-0-on-dead-owner-task.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 40f5b617ba64bfbd50b469718fb24c2b4557230e
Author: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>
Date:   Wed Feb 3 15:41:56 2021 +0300

    fcntl: make F_GETOWN(EX) return 0 on dead owner task
    
    [ Upstream commit cc4a3f885e8f2bc3c86a265972e94fef32d68f67 ]
    
    Currently there is no way to differentiate the file with alive owner
    from the file with dead owner but pid of the owner reused. That's why
    CRIU can't actually know if it needs to restore file owner or not,
    because if it restores owner but actual owner was dead, this can
    introduce unexpected signals to the "false"-owner (which reused the
    pid).
    
    Let's change the api, so that F_GETOWN(EX) returns 0 in case actual
    owner is dead already. This comports with the POSIX spec, which
    states that a PID of 0 indicates that no signal will be sent.
    
    Cc: Jeff Layton <jlayton@xxxxxxxxxx>
    Cc: "J. Bruce Fields" <bfields@xxxxxxxxxxxx>
    Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx>
    Cc: linux-fsdevel@xxxxxxxxxxxxxxx
    Cc: linux-kernel@xxxxxxxxxxxxxxx
    Cc: Cyrill Gorcunov <gorcunov@xxxxxxxxx>
    Cc: Andrei Vagin <avagin@xxxxxxxxx>
    Signed-off-by: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>
    Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>
    Stable-dep-of: f671a691e299 ("fcntl: fix potential deadlocks for &fown_struct.lock")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 71b43538fa44..5a56351f1fc3 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -148,11 +148,15 @@ void f_delown(struct file *filp)
 
 pid_t f_getown(struct file *filp)
 {
-	pid_t pid;
+	pid_t pid = 0;
 	read_lock(&filp->f_owner.lock);
-	pid = pid_vnr(filp->f_owner.pid);
-	if (filp->f_owner.pid_type == PIDTYPE_PGID)
-		pid = -pid;
+	rcu_read_lock();
+	if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) {
+		pid = pid_vnr(filp->f_owner.pid);
+		if (filp->f_owner.pid_type == PIDTYPE_PGID)
+			pid = -pid;
+	}
+	rcu_read_unlock();
 	read_unlock(&filp->f_owner.lock);
 	return pid;
 }
@@ -200,11 +204,14 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
 static int f_getown_ex(struct file *filp, unsigned long arg)
 {
 	struct f_owner_ex __user *owner_p = (void __user *)arg;
-	struct f_owner_ex owner;
+	struct f_owner_ex owner = {};
 	int ret = 0;
 
 	read_lock(&filp->f_owner.lock);
-	owner.pid = pid_vnr(filp->f_owner.pid);
+	rcu_read_lock();
+	if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type))
+		owner.pid = pid_vnr(filp->f_owner.pid);
+	rcu_read_unlock();
 	switch (filp->f_owner.pid_type) {
 	case PIDTYPE_PID:
 		owner.type = F_OWNER_TID;