Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp1982837pxa; Sun, 16 Aug 2020 18:45:06 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzGwvkktBTPmxL7oAel19bsTuU6RW7xZL0nX986cfUP4z3+cqFmq433fAFqof+BsJXmOKtE X-Received: by 2002:a05:6402:1457:: with SMTP id d23mr12826182edx.149.1597628706719; Sun, 16 Aug 2020 18:45:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597628706; cv=none; d=google.com; s=arc-20160816; b=qrWfBqpn0fO1xstAgaCvZvX/flrvi967ks6q+tuCuAfOdArE8ZvWLXAEYU0gvRTr3T jz4jJs5xyBXs223KhdQrL4hKkzBq0DJn73GrviXiy3uVlbzpxt0J5LEw2DrtmObwZwqo nW5Zc3yQwuePrki8qvREJlW2PisHKv3rSp3otbNiR6OP14AOIaoKvjBQHj2HTeYQ+Cp3 Dy/asXRR+MW5Z2gh3jW++VkS4E1bAzrt6NLApbQdtCnvNkVz7Hn3QfcMbMijWL1pGdYe r2zUz98TtnrDplzyLNkf9R61jReUa+2cEjcYw55bmevhyb/Ov1vTnFySI3BkGPJN2nj2 qwCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=4jCOHwQeB5YPw0YdQ8CXaL/Uo23wijM3/3/C2XgOYOc=; b=XzPU3WyGzqbYgiNZIWUUNjllfL9jxYexlrEsKV4V/WMzaFBsu5ueAwpaQcus7gN7ZI 0ayYvov2ydbVACfZh6Qg0UzCsbUgNUwmb32XHOHnQ5c7mR12UtwL59Lj6R/PQPFCAl0+ 2savtsFhsCzdFwvGEVGFunR3ENuJCi46FgqHHuvLEhwUx4LOCrefL0o+nyhHkKoyyCab yDRkEsQEgDjJkdIEUzAmPhU7TnueziuohGira2efk544eQ/OdvMSRUwHhY9Aj62k8lOE /Sr0VStoDEqz++fjffCm17c7+g/q7buFHiGsBWeOR59ibX6JsRZ/AZLbGd+eePZfvktJ m64Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id i28si12600332edj.373.2020.08.16.18.44.43; Sun, 16 Aug 2020 18:45:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726690AbgHQAp1 (ORCPT + 99 others); Sun, 16 Aug 2020 20:45:27 -0400 Received: from mx2.suse.de ([195.135.220.15]:54704 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726451AbgHQApZ (ORCPT ); Sun, 16 Aug 2020 20:45:25 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 24924AC23; Mon, 17 Aug 2020 00:45:49 +0000 (UTC) From: Davidlohr Bueso To: akpm@linux-foundation.org Cc: oleg@redhat.com, axboe@kernel.dk, linux-kernel@vger.kernel.org, Davidlohr Bueso , Greg Thelen , Davidlohr Bueso Subject: [PATCH 2/2] block: fix ioprio_get/set(IOPRIO_WHO_PGRP) vs setuid(2) Date: Sun, 16 Aug 2020 17:31:48 -0700 Message-Id: <20200817003148.23691-3-dave@stgolabs.net> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200817003148.23691-1-dave@stgolabs.net> References: <20200817003148.23691-1-dave@stgolabs.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent change_pid(PIDTYPE_PGID) that can move the task from one hlist to another while iterating. Serialize ioprio_get/set to take the tasklist_lock in this case. Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}()) Cc: Greg Thelen Signed-off-by: Davidlohr Bueso --- block/ioprio.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/ioprio.c b/block/ioprio.c index 77bcab11dce5..4ede2da961bb 100644 --- a/block/ioprio.c +++ b/block/ioprio.c @@ -119,11 +119,13 @@ SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio) pgrp = task_pgrp(current); else pgrp = find_vpid(who); + read_lock(&tasklist_lock); do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { ret = set_task_ioprio(p, ioprio); if (ret) break; } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); + read_unlock(&tasklist_lock); break; case IOPRIO_WHO_USER: uid = make_kuid(current_user_ns(), who); @@ -207,6 +209,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) pgrp = task_pgrp(current); else pgrp = find_vpid(who); + read_lock(&tasklist_lock); do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { tmpio = get_task_ioprio(p); if (tmpio < 0) @@ -216,6 +219,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) else ret = ioprio_best(ret, tmpio); } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); + read_unlock(&tasklist_lock); break; case IOPRIO_WHO_USER: uid = make_kuid(current_user_ns(), who); -- 2.26.2