The commit is pushed to "branch-rh7-3.10.0-693.1.1.vz7.37.x-ovz" and will
appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.1.1.vz7.37.16
------>
commit 4856f5d044f061c8c1491752d4dd31151b24d399
Author: Eric Dumazet <eduma...@google.com>
Date: Thu Oct 19 12:01:00 2017 +0300
ms/pidns: fix NULL dereference in __task_pid_nr_ns()
commit 81b1a832d79749058863cffe2c0ed4ef40f6e6ec upstream.
I got a crash during a "perf top" session that was caused by a race in
__task_pid_nr_ns() :
pid_nr_ns() was inlined, but apparently compiler chose to read
task->pids[type].pid twice, and the pid->level dereference crashed
because we got a NULL pointer at the second read :
if (pid && ns->level <= pid->level) { // CRASH
Just use RCU API properly to solve this race, and not worry about "perf
top" crashing hosts :(
get_task_pid() can benefit from same fix.
Signed-off-by: Eric Dumazet <eduma...@google.com>
Signed-off-by: Linus Torvalds <torva...@linux-foundation.org>
https://jira.sw.ru/browse/PSBM-75247
Signed-off-by: Andrey Ryabinin <aryabi...@virtuozzo.com>
---
kernel/pid.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/pid.c b/kernel/pid.c
index 4f8d1d6..d1f9d4c 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -511,7 +511,7 @@ struct pid *get_task_pid(struct task_struct *task, enum
pid_type type)
rcu_read_lock();
if (type != PIDTYPE_PID)
task = task->group_leader;
- pid = get_pid(task->pids[type].pid);
+ pid = get_pid(rcu_dereference(task->pids[type].pid));
rcu_read_unlock();
return pid;
}
@@ -572,7 +572,7 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum
pid_type type,
if (likely(pid_alive(task))) {
if (type != PIDTYPE_PID)
task = task->group_leader;
- nr = pid_nr_ns(task->pids[type].pid, ns);
+ nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns);
}
rcu_read_unlock();
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
