pids: make task_tgid_nr_ns() safe
authorOleg Nesterov <oleg@redhat.com>
Mon, 21 Aug 2017 15:35:02 +0000 (17:35 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 25 Aug 2017 00:00:10 +0000 (17:00 -0700)
commit63407c4d1f9f64015974206e9bf40b318fdd74ee
tree101c14cd7d1d1fd8916827412b9ec869ceb1abe9
parent8cf95002f0c9afe06fa1e4b9ebb0e10a77c481b1
pids: make task_tgid_nr_ns() safe

commit dd1c1f2f2028a7b851f701fc6a8ebe39dcb95e7c upstream.

This was reported many times, and this was even mentioned in commit
52ee2dfdd4f5 ("pids: refactor vnr/nr_ns helpers to make them safe") but
somehow nobody bothered to fix the obvious problem: task_tgid_nr_ns() is
not safe because task->group_leader points to nowhere after the exiting
task passes exit_notify(), rcu_read_lock() can not help.

We really need to change __unhash_process() to nullify group_leader,
parent, and real_parent, but this needs some cleanups.  Until then we
can turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and
fix the problem.

Reported-by: Troy Kensinger <tkensinger@google.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/linux/pid.h
include/linux/sched.h
kernel/pid.c