linux-kernel - [PATCH 1/3] pids: document task_pgrp/task_session is not safe without tasklist/rcu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 16 Jan 2009 06:55:13 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Pavel Emelyanov <xemul@...nvz.org>,
	Sukadev Bhattiprolu <sukadev@...ux.vnet.ibm.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH 1/3] pids: document task_pgrp/task_session is not safe
	without tasklist/rcu

Even if task == current, it is not safe to dereference the result of
task_pgrp/task_session. We can race with another thread which changes
the special pid via setpgid/setsid.

Document this. The next 2 patches give an example of the unsafe usage,
we have more bad users.

Signed-off-by: Oleg Nesterov <oleg@...hat.com>

--- CUR/include/linux/sched.h~SP_1_COMMENT	2009-01-12 23:07:48.000000000 +0100
+++ CUR/include/linux/sched.h	2009-01-16 02:13:50.000000000 +0100
@@ -1449,6 +1449,13 @@ static inline struct pid *task_tgid(stru
 	return task->group_leader->pids[PIDTYPE_PID].pid;
 }
 
+/*
+ * Without tasklist or rcu lock it is not safe to dereference
+ * the result of task_pgrp/task_session even if task == current,
+ * we can race with another thread doing sys_setsid/sys_setpgid.
+ *
+ */
+
 static inline struct pid *task_pgrp(struct task_struct *task)
 {
 	return task->group_leader->pids[PIDTYPE_PGID].pid;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/