Home » Mailing list archives » linux-kernel » 2007 » November » 17

[PATCH] task_pid_nr_ns() breaks proc_pid_readdir()

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Oleg Nesterov <oleg@...>
To: Andrew Morton <akpm@...>
Cc: Eric W. Biederman <ebiederm@...>, Pavel Emelyanov <xemul@...>, <linux-kernel@...>
Subject: [PATCH] task_pid_nr_ns() breaks proc_pid_readdir()
Date: Saturday, November 17, 2007 - 2:15 pm

proc_pid_readdir:

	for (...; ...; task = next_tgid(tgid + 1, ns)) {
		tgid = task_pid_nr_ns(task, ns);
		... use tgid ...

The first problem is that task_pid_nr_ns() can race with RCU and read the
freed memory.

However, rcu_read_lock() can't help. next_tgid() returns a pinned task_struct,
but the task can be released (and it's pid detached) before task_pid_nr_ns()
reads the pid_t value. In that case task_pid_nr_ns() returns 0 thus breaking
the whole logic.

Make sure that task_pid_nr_ns() returns !0 before updating tgid. Note that
next_tgid(tgid + 1) can find the same "struct pid" again, but we shouldn't
go into the endless loop because pid_task(PIDTYPE_PID) must return NULL in
this case, so next_tgid() can't return the same task.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>

--- 24/fs/proc/base.c~pprd	2007-10-25 16:22:11.000000000 +0400
+++ 24/fs/proc/base.c	2007-11-17 20:58:14.000000000 +0300
@@ -2481,7 +2481,15 @@ int proc_pid_readdir(struct file * filp,
 	for (task = next_tgid(tgid, ns);
 	     task;
 	     put_task_struct(task), task = next_tgid(tgid + 1, ns)) {
-		tgid = task_pid_nr_ns(task, ns);
+		int nr;
+
+		rcu_read_lock();
+		nr = task_pid_nr_ns(task, ns);
+		rcu_read_unlock();
+		if (!nr)
+			continue;
+
+		tgid = nr;
 		filp->f_pos = tgid + TGID_OFFSET;
 		if (proc_pid_fill_cache(filp, dirent, filldir, task, tgid) < 0) {
 			put_task_struct(task);

-
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[PATCH] task_pid_nr_ns() breaks proc_pid_readdir(), Oleg Nesterov, (Sat Nov 17, 2:15 pm)
Re: [PATCH] task_pid_nr_ns() breaks proc_pid_readdir(), Eric W. Biederman, (Sat Nov 17, 4:35 pm)
Re: [PATCH] task_pid_nr_ns() breaks proc_pid_readdir(), Oleg Nesterov, (Sun Nov 18, 10:20 am)
Re: [PATCH] task_pid_nr_ns() breaks proc_pid_readdir(), Eric W. Biederman, (Mon Nov 19, 2:15 pm)
Re: [PATCH] task_pid_nr_ns() breaks proc_pid_readdir(), Oleg Nesterov, (Mon Nov 19, 2:29 pm)
[PATCH] proc: Remove races from proc_id_readdir(), Eric W. Biederman, (Mon Nov 19, 5:44 pm)
[PATCH] proc-remove-races-from-proc_id_readdir-factor-out-tg..., Oleg Nesterov, (Tue Nov 20, 12:34 pm)
Re: [PATCH] proc-remove-races-from-proc_id_readdir-factor-ou..., Eric W. Biederman, (Tue Nov 20, 4:45 pm)
Re: [PATCH] task_pid_nr_ns() breaks proc_pid_readdir(), Eric W. Biederman, (Mon Nov 19, 2:50 pm)