Commit a872ff0c authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

[PATCH] simplify/fix first_tid() 



first_tid:

	/* If nr exceeds the number of threads there is nothing todo */
	if (nr) {
		if (nr >= get_nr_threads(leader))
			goto done;
	}

This is not reliable: sub-threads can exit after this check, so the
'for' loop below can overlap and proc_task_readdir() can return an
already filldir'ed dirents.

	for (; pos && pid_alive(pos); pos = next_thread(pos)) {
		if (--nr > 0)
			continue;

Off-by-one error, will return 'leader' when nr == 1.

This patch tries to fix these problems and simplify the code.

Signed-off-by: default avatarOleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent cc288738

fs/proc/base.c

+17 −21
Original line number Diff line number Diff line
@@ -2227,38 +2227,34 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir) 
static struct task_struct *first_tid(struct task_struct *leader,

					int tid, int nr)

{

	struct task_struct *pos = NULL;

	struct task_struct *pos;



	rcu_read_lock();

	/* Attempt to start with the pid of a thread */

	if (tid && (nr > 0)) {

		pos = find_task_by_pid(tid);

		if (pos && (pos->group_leader != leader))

			pos = NULL;

		if (pos)

			nr = 0;

		if (pos && (pos->group_leader == leader))

			goto found;

	}



	/* If nr exceeds the number of threads there is nothing todo */

	if (nr) {

		if (nr >= get_nr_threads(leader))

			goto done;

	}

	pos = NULL;

	if (nr && nr >= get_nr_threads(leader))

		goto out;



	/* If we haven't found our starting place yet start with the

	 * leader and walk nr threads forward.

	/* If we haven't found our starting place yet start

	 * with the leader and walk nr threads forward.

	 */

	if (!pos && (nr >= 0))

		pos = leader;



	for (; pos && pid_alive(pos); pos = next_thread(pos)) {

		if (--nr > 0)

			continue;

		get_task_struct(pos);

		goto done;

	}

	for (pos = leader; nr > 0; --nr) {

		pos = next_thread(pos);

		if (pos == leader) {

			pos = NULL;

done:

			goto out;

		}

	}

found:

	get_task_struct(pos);

out:

	rcu_read_unlock();

	return pos;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE