Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752733AbbF1TVY (ORCPT ); Sun, 28 Jun 2015 15:21:24 -0400 Received: from mail-qg0-f44.google.com ([209.85.192.44]:34268 "EHLO mail-qg0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752600AbbF1TVX (ORCPT ); Sun, 28 Jun 2015 15:21:23 -0400 Message-ID: <5590492F.9010507@hurleysoftware.com> Date: Sun, 28 Jun 2015 15:21:19 -0400 From: Peter Hurley User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Patrick Donnelly CC: Greg Kroah-Hartman , Jiri Slaby , open list Subject: Re: [PATCH v2 1/2] tty: add missing rcu_read_lock for task_pgrp References: <1435439824-3975-1-git-send-email-batrick@batbytes.com> <1435452689-25390-1-git-send-email-batrick@batbytes.com> <5590115A.3000201@hurleysoftware.com> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1375 Lines: 30 On 06/28/2015 01:20 PM, Patrick Donnelly wrote: > On Sun, Jun 28, 2015 at 11:23 AM, Peter Hurley wrote: >> On 06/27/2015 08:51 PM, Patrick Donnelly wrote: >>> task_pgrp requires an rcu or tasklist lock to be obtained if the returned pid >>> is to be dereferenced, which kill_pgrp does. Obtain an RCU lock for the >>> duration of use. >> >> kill_pgrp() obtains tasklist_lock, so I don't see an unsafe deref. > > I see a race between looking up the pgrp via task_pgrp and passing it > to kill_pgrp. The pgrp struct pid may be freed via setpgid/setsid, as > mentioned in the comment for task_pgrp: > > * Without tasklist or rcu lock it is not safe to dereference > * the result of task_pgrp/task_session even if task == current, > * we can race with another thread doing sys_setsid/sys_setpgid. > > Getting the lock after the lookup is getting the lock too late. I > could be wrong though as I'm no expert on locking in Linux. I suppose it can't hurt; please add similar logic to job_control() in drivers/tty/n_tty.c which handles the corresponding SIGTTIN signal conditions. Regards, Peter Hurley -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/