Re: [PATCH] pidhash: Kill switch_exec_pids

[Oleg Nesterov <oleg@tv-sign.ru>]

Eric W. Biederman wrote:
>
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -699,7 +699,17 @@ static int de_thread(struct task_struct 
>  		remove_parent(current);
>  		remove_parent(leader);
>  
> -		switch_exec_pids(leader, current);
> +
> +		/* Become a process group leader with the old leader's pid.
> +		 * Note: The old leader also uses thispid until release_task
> +		 *       is called.  Odd but simple and correct.
> +		 */
> +		detach_pid(current, PIDTYPE_PID);
> +		current->pid = leader->pid;
> +		attach_pid(current, PIDTYPE_PID,  current->pid);

What happens after de_thread() unlocks tasklist_lock and before
it is taken again in release_task() ?

In that window find_task_by_pid() will return dead leader, not
the new leader of thread group. This means we can miss tkill()
or ptrace(), for example.

Oleg.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/