On 08/30, Jiri Slaby wrote:
quoted text
>
> Ccing Oleg.

Sorry for delay...

quoted text
> > --- a/kernel/sys.c
> > +++ b/kernel/sys.c
> > @@ -938,6 +938,7 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
> >  	write_lock_irq(&tasklist_lock);
> >
> >  	err = -ESRCH;
> > +	rcu_read_lock();
> >  	p = find_task_by_vpid(pid);
>
> AFAICT the missing lock doesn't harm due to the write_lock of tasklist
> above. But is probably a good thing to do anyway.

The problem is, find_task_by_vpid() is not safe without RCU. It is not
that the returned task_struct can't go away, find_pid_ns() itself is
not safe. This is because the failing copy_process() calls free_pid()
without tasklist_lock and modifies pid_hash[] list.

Oleg.

--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/