Commit 81907739 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

kernel/fork.c:copy_process(): don't add the uninitialized child to thread/task/pid lists 



copy_process() adds the new child to thread_group/init_task.tasks list and
then does attach_pid(child, PIDTYPE_PID).  This means that the lockless
next_thread() or next_task() can see this thread with the wrong pid.  Say,
"ls /proc/pid/task" can list the same inode twice.

We could move attach_pid(child, PIDTYPE_PID) up, but in this case
find_task_by_vpid() can find the new thread before it was fully
initialized.

And this is already true for PIDTYPE_PGID/PIDTYPE_SID, With this patch
copy_process() initializes child->pids[*].pid first, then calls
attach_pid() to insert the task into the pid->tasks list.

attach_pid() no longer need the "struct pid*" argument, it is always
called after pid_link->pid was already set.

Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Sergey Dyasly <dserrg@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 80628ca0

include/linux/pid.h

+2 −4
Original line number Diff line number Diff line
@@ -86,11 +86,9 @@ extern struct task_struct *get_pid_task(struct pid *pid, enum pid_type); 
extern struct pid *get_task_pid(struct task_struct *task, enum pid_type type);



/*

 * attach_pid() and detach_pid() must be called with the tasklist_lock

 * write-held.

 * these helpers must be called with the tasklist_lock write-held.

 */

extern void attach_pid(struct task_struct *task, enum pid_type type,

			struct pid *pid);

extern void attach_pid(struct task_struct *task, enum pid_type);

extern void detach_pid(struct task_struct *task, enum pid_type);

extern void change_pid(struct task_struct *task, enum pid_type,

			struct pid *pid);

kernel/fork.c

+13 −3
Original line number Diff line number Diff line
@@ -1121,6 +1121,12 @@ static void posix_cpu_timers_init(struct task_struct *tsk) 
	INIT_LIST_HEAD(&tsk->cpu_timers[2]);

}



static inline void

init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)

{

	 task->pids[type].pid = pid;

}



/*

 * This creates a new process as a copy of the old one,

 * but does not actually start it yet.
@@ -1449,7 +1455,11 @@ static struct task_struct *copy_process(unsigned long clone_flags, 
	if (likely(p->pid)) {

		ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);



		init_task_pid(p, PIDTYPE_PID, pid);

		if (thread_group_leader(p)) {

			init_task_pid(p, PIDTYPE_PGID, task_pgrp(current));

			init_task_pid(p, PIDTYPE_SID, task_session(current));



			if (is_child_reaper(pid)) {

				ns_of_pid(pid)->child_reaper = p;

				p->signal->flags |= SIGNAL_UNKILLABLE;
@@ -1457,10 +1467,10 @@ static struct task_struct *copy_process(unsigned long clone_flags, 


			p->signal->leader_pid = pid;

			p->signal->tty = tty_kref_get(current->signal->tty);

			attach_pid(p, PIDTYPE_PGID, task_pgrp(current));

			attach_pid(p, PIDTYPE_SID, task_session(current));

			list_add_tail(&p->sibling, &p->real_parent->children);

			list_add_tail_rcu(&p->tasks, &init_task.tasks);

			attach_pid(p, PIDTYPE_PGID);

			attach_pid(p, PIDTYPE_SID);

			__this_cpu_inc(process_counts);

		} else {

			current->signal->nr_threads++;
@@ -1470,7 +1480,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, 
			list_add_tail_rcu(&p->thread_group,

					  &p->group_leader->thread_group);

		}

		attach_pid(p, PIDTYPE_PID, pid);

		attach_pid(p, PIDTYPE_PID);

		nr_threads++;

	}

kernel/pid.c

+4 −8
Original line number Diff line number Diff line
@@ -373,14 +373,10 @@ EXPORT_SYMBOL_GPL(find_vpid); 
/*

 * attach_pid() must be called with the tasklist_lock write-held.

 */

void attach_pid(struct task_struct *task, enum pid_type type,

		struct pid *pid)

void attach_pid(struct task_struct *task, enum pid_type type)

{

	struct pid_link *link;



	link = &task->pids[type];

	link->pid = pid;

	hlist_add_head_rcu(&link->node, &pid->tasks[type]);

	struct pid_link *link = &task->pids[type];

	hlist_add_head_rcu(&link->node, &link->pid->tasks[type]);

}



static void __change_pid(struct task_struct *task, enum pid_type type,
@@ -412,7 +408,7 @@ void change_pid(struct task_struct *task, enum pid_type type, 
		struct pid *pid)

{

	__change_pid(task, type, pid);

	attach_pid(task, type, pid);

	attach_pid(task, type);

}



/* transfer_pid is an optimization of attach_pid(new), detach_pid(old) */

CRA Git | Maintained and supported by SUSTech CRA and CCSE