From: Corey Minyard <cminyard@xxxxxxxxxx> Recent changes to alloc_pid() allow the pid number to be specified on the command line. If set_tid_size is set, then the code scanning the levels will hard-set retval to -EPERM, overriding it's previous -ENOMEM value. After the code scanning the levels, there are error returns that do not set retval, assuming it is still set to -ENOMEM. In the first place, pid_ns_prepare_proc() returns its own error, just use that. In the second place: if (!(ns->pid_allocated & PIDNS_ADDING)) goto out_unlock; a return value of -ENOMEM is probably wrong, since that means that the namespace is in deletion while this happened. -EINVAL is probably a better choice. Fixes: 49cb2fc42ce4 "fork: extend clone3() to support setting a PID" Signed-off-by: Corey Minyard <cminyard@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> # 5.5 Cc: Adrian Reber <areber@xxxxxxxxxx> Cc: Christian Brauner <christian.brauner@xxxxxxxxxx> Cc: Oleg Nesterov <oleg@xxxxxxxxxx> Cc: Dmitry Safonov <0x7f454c46@xxxxxxxxx> Cc: Andrei Vagin <avagin@xxxxxxxxx> Cc: Christian Brauner <christian.brauner@xxxxxxxxxx> --- kernel/pid.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kernel/pid.c b/kernel/pid.c index 0f4ecb57214c..1921f7f4b236 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -248,7 +248,8 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid, } if (unlikely(is_child_reaper(pid))) { - if (pid_ns_prepare_proc(ns)) + retval = pid_ns_prepare_proc(ns); + if (retval) goto out_free; } @@ -261,8 +262,10 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid, upid = pid->numbers + ns->level; spin_lock_irq(&pidmap_lock); - if (!(ns->pid_allocated & PIDNS_ADDING)) + if (!(ns->pid_allocated & PIDNS_ADDING)) { + retval = -EINVAL; goto out_unlock; + } for ( ; upid >= pid->numbers; --upid) { /* Make the PID visible to find_pid_ns. */ idr_replace(&upid->ns->idr, pid, upid->nr); -- 2.17.1