linux-kernel - [PATCH 15/23] pid: Eextract child_reaper check from pidns_for_children

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Jul 2020 15:00:41 +0300
From:   Kirill Tkhai <ktkhai@...tuozzo.com>
To:     viro@...iv.linux.org.uk, adobriyan@...il.com, davem@...emloft.net,
        ebiederm@...ssion.com, akpm@...ux-foundation.org,
        christian.brauner@...ntu.com, areber@...hat.com, serge@...lyn.com,
        linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        ktkhai@...tuozzo.com
Subject: [PATCH 15/23] pid: Eextract child_reaper check from
 pidns_for_children_get()

This check if for prohibiting access to /proc/[pid]/ns/pid_for_children
before first task of the pid namespace is created.

/proc/namespaces/ code will use this check too, so we move it into
a separate function.

Signed-off-by: Kirill Tkhai <ktkhai@...tuozzo.com>
---
 kernel/pid_namespace.c |   25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index d02dc1696edf..4a01328e8763 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -343,6 +343,21 @@ static struct ns_common *pidns_get(struct task_struct *task)
 	return ns ? &ns->ns : NULL;
 }
 
+static bool pidns_can_get(struct ns_common *ns)
+{
+	struct pid_namespace *pid_ns;
+	bool ret = true;
+
+	pid_ns = container_of(ns, struct pid_namespace, ns);
+
+	read_lock(&tasklist_lock);
+	if (!pid_ns->child_reaper)
+		ret = false;
+	read_unlock(&tasklist_lock);
+
+	return ret;
+}
+
 static struct ns_common *pidns_for_children_get(struct task_struct *task)
 {
 	struct pid_namespace *ns = NULL;
@@ -354,13 +369,9 @@ static struct ns_common *pidns_for_children_get(struct task_struct *task)
 	}
 	task_unlock(task);
 
-	if (ns) {
-		read_lock(&tasklist_lock);
-		if (!ns->child_reaper) {
-			put_pid_ns(ns);
-			ns = NULL;
-		}
-		read_unlock(&tasklist_lock);
+	if (ns && !pidns_can_get(&ns->ns)) {
+		put_pid_ns(ns);
+		ns = NULL;
 	}
 
 	return ns ? &ns->ns : NULL;