diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2019-05-10 13:07:55 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-05-10 13:07:55 -0400 |
| commit | 3232b43f7252e04efd703ca8ecb87e2567a36388 (patch) | |
| tree | 230e83a1cce18f9ecab3670a15a8d4d601999293 | |
| parent | 7817ffd20a0f7fbd5971643b5ef1f577703dad11 (diff) | |
| parent | c3b7112df86b769927a60a6d7175988ca3d60f09 (diff) | |
| download | linux-3232b43f7252e04efd703ca8ecb87e2567a36388.tar.bz2 | |
Merge tag 'pidfd-fixes-v5.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux
Pull pidfd fixes from Christian Brauner:
"This fixes two bugs:
- The first one reported by Linus whereby the pidfd-metadata binary
was not placed in a .gitignore file.
- The second one is rather urgent and fixes a locking issue found by
syzkaller.
What happened is that during process creation we need to check
whether the cgroup we are in allows us to fork. To perform this
check the cgroup needs to guard itself against threadgroup changes
and takes a lock.
Prior to CLONE_PIDFD the cleanup target "bad_fork_free_pid" would
also need to release said lock. That's not true anymore since
CLONE_PIDFD so this is fixed here.
Syzkaller has tested the patch and was not able to reproduce the
issue"
* tag 'pidfd-fixes-v5.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux:
fork: do not release lock that wasn't taken
samples: add .gitignore for pidfd-metadata
| -rw-r--r-- | kernel/fork.c | 5 | ||||
| -rw-r--r-- | samples/pidfd/.gitignore | 1 |
2 files changed, 4 insertions, 2 deletions
diff --git a/kernel/fork.c b/kernel/fork.c index 5359facf9867..737db1828437 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2102,7 +2102,7 @@ static __latent_entropy struct task_struct *copy_process( */ retval = cgroup_can_fork(p); if (retval) - goto bad_fork_put_pidfd; + goto bad_fork_cgroup_threadgroup_change_end; /* * From this point on we must avoid any synchronous user-space @@ -2217,11 +2217,12 @@ bad_fork_cancel_cgroup: spin_unlock(¤t->sighand->siglock); write_unlock_irq(&tasklist_lock); cgroup_cancel_fork(p); +bad_fork_cgroup_threadgroup_change_end: + cgroup_threadgroup_change_end(current); bad_fork_put_pidfd: if (clone_flags & CLONE_PIDFD) ksys_close(pidfd); bad_fork_free_pid: - cgroup_threadgroup_change_end(current); if (pid != &init_struct_pid) free_pid(pid); bad_fork_cleanup_thread: diff --git a/samples/pidfd/.gitignore b/samples/pidfd/.gitignore new file mode 100644 index 000000000000..be52b3ba6e4b --- /dev/null +++ b/samples/pidfd/.gitignore @@ -0,0 +1 @@ +pidfd-metadata |