* [PATCH] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
@ 2021-12-10 18:20 Davidlohr Bueso
2021-12-10 18:26 ` Jens Axboe
0 siblings, 1 reply; 2+ messages in thread
From: Davidlohr Bueso @ 2021-12-10 18:20 UTC (permalink / raw)
To: axboe; +Cc: oleg, linux-block, linux-kernel, dave, Davidlohr Bueso
do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent
change_pid(PIDTYPE_PGID) that can move the task from one hlist
to another while iterating. Serialize ioprio_get to take
the tasklist_lock in this case, just like it's set counterpart.
Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}())
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
---
This is basically a resend of https://lore.kernel.org/all/20200817003148.23691-3-dave@stgolabs.net/
with Oleg's ack and without the ioprio_set part as this was fixed
later after this patch was lost for whatever reason.
block/ioprio.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/block/ioprio.c b/block/ioprio.c
index 313c14a70bbd..6f01d35a5145 100644
--- a/block/ioprio.c
+++ b/block/ioprio.c
@@ -220,6 +220,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
pgrp = task_pgrp(current);
else
pgrp = find_vpid(who);
+ read_lock(&tasklist_lock);
do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
tmpio = get_task_ioprio(p);
if (tmpio < 0)
@@ -229,6 +230,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
else
ret = ioprio_best(ret, tmpio);
} while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
+ read_unlock(&tasklist_lock);
+
break;
case IOPRIO_WHO_USER:
uid = make_kuid(current_user_ns(), who);
--
2.26.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
2021-12-10 18:20 [PATCH] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) Davidlohr Bueso
@ 2021-12-10 18:26 ` Jens Axboe
0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2021-12-10 18:26 UTC (permalink / raw)
To: Davidlohr Bueso; +Cc: linux-kernel, Davidlohr Bueso, oleg, linux-block
On Fri, 10 Dec 2021 10:20:58 -0800, Davidlohr Bueso wrote:
> do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent
> change_pid(PIDTYPE_PGID) that can move the task from one hlist
> to another while iterating. Serialize ioprio_get to take
> the tasklist_lock in this case, just like it's set counterpart.
>
>
Applied, thanks!
[1/1] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
commit: e6a59aac8a8713f335a37d762db0dbe80e7f6d38
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-12-10 18:26 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-10 18:20 [PATCH] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) Davidlohr Bueso
2021-12-10 18:26 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).