linux-kernel - Re: [PATCH] Fix a race in pid generation that causes pids to be reused immediately.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100609121706.GD6529@thunk.org>
Date:	Wed, 9 Jun 2010 08:17:06 -0400
From:	tytso@....edu
To:	Salman <sqazi@...gle.com>
Cc:	peterz@...radead.org, mingo@...e.hu, akpm@...x-foundation.org,
	linux-kernel@...r.kernel.org, tytso@...gle.com
Subject: Re: [PATCH] Fix a race in pid generation that causes pids to be
 reused immediately.

On Tue, Jun 08, 2010 at 11:24:38PM -0700, Salman wrote:

> A program that repeatedly forks and waits is susceptible to having
> the same pid repeated, especially when it competes with another
> instance of the same program.  This is really bad for bash
> implementation.  Furthermore, many shell scripts assume that pid
> numbers will not be used for some length of time.
> 
> Thanks to Ted Tso for the key ideas of this implementation.
> 
> Signed-off-by: Salman Qazi <sqazi@...gle.com>

Here's a slightly more succint way of expressing it.  Others will have
decide if it's easier to understand.  (It is for me, but I wrote it.  :-P)

       	       	      	 	      	  - Ted

 kernel/pid.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/kernel/pid.c b/kernel/pid.c
index e9fd8c1..c51f413 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -154,8 +154,13 @@ static int alloc_pidmap(struct pid_namespace *pid_ns)
 			do {
 				if (!test_and_set_bit(offset, map->page)) {
 					atomic_dec(&map->nr_free);
-					pid_ns->last_pid = pid;
-					return pid;
+					while (1) {
+						i = cmpxchg(&pid_ns->last_pid,
+							    last, pid);
+						if (i == last || i >= pid)
+							return pid;
+						last = i;
+					}
 				}
 				offset = find_next_offset(map, offset);
 				pid = mk_pid(pid_ns, map, offset);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/