aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKirill Korotaev <dev@openvz.org>2006-11-24 03:08:27 +0100
committerAdrian Bunk <bunk@stusta.de>2006-11-24 03:08:27 +0100
commit7eeeab0403c1d0dffbbe236e229ab98fde0aacac (patch)
tree0d5e1ec5dd71c1953a706f3d837f7f1fd3a1b286
parentd6042b2ec9446e7955d72a2155a4dff473ccc511 (diff)
downloadlinux-linaro-stable-7eeeab0403c1d0dffbbe236e229ab98fde0aacac.tar.gz
fix sys_getppid oopses on debug kernel
sys_getppid() optimization can access a freed memory. On kernels with DEBUG_SLAB turned ON, this results in Oops. As Dave Hansen noted, this optimization is also unsafe for memory hotplug. So this patch always takes the lock to be safe. Signed-off-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
-rw-r--r--kernel/timer.c41
1 files changed, 7 insertions, 34 deletions
diff --git a/kernel/timer.c b/kernel/timer.c
index 2410c18dbeb1..e67858ece81a 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -994,46 +994,19 @@ asmlinkage long sys_getpid(void)
}
/*
- * Accessing ->group_leader->real_parent is not SMP-safe, it could
- * change from under us. However, rather than getting any lock
- * we can use an optimistic algorithm: get the parent
- * pid, and go back and check that the parent is still
- * the same. If it has changed (which is extremely unlikely
- * indeed), we just try again..
- *
- * NOTE! This depends on the fact that even if we _do_
- * get an old value of "parent", we can happily dereference
- * the pointer (it was and remains a dereferencable kernel pointer
- * no matter what): we just can't necessarily trust the result
- * until we know that the parent pointer is valid.
- *
- * NOTE2: ->group_leader never changes from under us.
+ * Accessing ->real_parent is not SMP-safe, it could
+ * change from under us. However, we can use a stale
+ * value of ->real_parent under rcu_read_lock(), see
+ * release_task()->call_rcu(delayed_put_task_struct).
*/
asmlinkage long sys_getppid(void)
{
int pid;
- struct task_struct *me = current;
- struct task_struct *parent;
- parent = me->group_leader->real_parent;
- for (;;) {
- pid = parent->tgid;
-#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
-{
- struct task_struct *old = parent;
+ rcu_read_lock();
+ pid = rcu_dereference(current->real_parent)->tgid;
+ rcu_read_unlock();
- /*
- * Make sure we read the pid before re-reading the
- * parent pointer:
- */
- smp_rmb();
- parent = me->group_leader->real_parent;
- if (old != parent)
- continue;
-}
-#endif
- break;
- }
return pid;
}