lkml.org 
[lkml]   [2021]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 27/53] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
    Date
    From: Davidlohr Bueso <dave@stgolabs.net>

    commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream.

    do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent
    change_pid(PIDTYPE_PGID) that can move the task from one hlist
    to another while iterating. Serialize ioprio_get to take
    the tasklist_lock in this case, just like it's set counterpart.

    Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}())
    Acked-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
    Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    block/ioprio.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/block/ioprio.c
    +++ b/block/ioprio.c
    @@ -196,6 +196,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
    pgrp = task_pgrp(current);
    else
    pgrp = find_vpid(who);
    + read_lock(&tasklist_lock);
    do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
    tmpio = get_task_ioprio(p);
    if (tmpio < 0)
    @@ -205,6 +206,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
    else
    ret = ioprio_best(ret, tmpio);
    } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
    + read_unlock(&tasklist_lock);
    +
    break;
    case IOPRIO_WHO_USER:
    uid = make_kuid(current_user_ns(), who);

    \
     
     \ /
      Last update: 2021-12-13 10:39    [W:2.927 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site