| Date | Tue, 27 Aug 2013 19:21:55 +0200 | From | Oleg Nesterov <> | Subject | Re: [PATCH 03/12] pid: get ppid pid_t of task in init_pid_ns safely |
| |
On 08/20, Richard Guy Briggs wrote: > > Added the functions > task_ppid() > task_ppid_nr_ns() > task_ppid_nr_init_ns() > to safely abstract the lookup of the PPID
but it is not safe.
> +static inline struct pid *task_ppid(struct task_struct *task) > +{ > + return task_tgid(rcu_dereference(current->real_parent)); ^^^^^^^ task?
> +static inline pid_t task_ppid_nr_ns(struct task_struct *tsk, > + struct pid_namespace *ns) > +{ > + pid_t pid; > + > + rcu_read_lock(); > + pid = pid_nr_ns(task_ppid(current), ns); ^^^^^^^ again.
> + rcu_read_unlock();
And why this is safe?
rcu_read_lock() can't help if tsk was already dead _before_ it takes the rcu lock. ->real_parent can point the already freed/reused/unmapped memory.
This is safe if, for example, the caller alredy holds rcu_read_lock() and tsk was found by find_task_by*(), or tsk is current.
Richard, just in case... I am going to vacation, I will be completely offline till Sep 10.
Oleg.
|