linux-kernel - [PATCH cgroup/for-6.18-fixes] cgroup: Skip showing PID 0 in cgroup.procs and cgroup.threads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <2016aece61b4da7ad86c6eca2dbcfd16@kernel.org>
Date: Thu, 06 Nov 2025 12:07:45 -1000
From: Tejun Heo <tj@...nel.org>
To: Johannes Weiner <hannes@...xchg.org>, Michal Koutný <mkoutny@...e.com>
Cc: cgroups@...r.kernel.org, linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: [PATCH cgroup/for-6.18-fixes] cgroup: Skip showing PID 0 in cgroup.procs and cgroup.threads

css_task_iter_next() pins and returns a task, but the task can do whatever
between that and cgroup_procs_show() being called, including dying and
losing its PID. When that happens, task_pid_vnr() returns 0.

d245698d727a ("cgroup: Defer task cgroup unlink until after the task is
done switching out") makes this more likely as tasks now stay iterable with
css_task_iter_next() until the last schedule is complete, which can be
after the task has lost its PID.

Showing "0" in cgroup.procs or cgroup.threads is confusing and can lead to
surprising outcomes. For example, if a user tries to kill PID 0, it kills
all processes in the current process group.

Skip entries with PID 0 by returning SEQ_SKIP.

Cc: stable@...r.kernel.org
Signed-off-by: Tejun Heo <tj@...nel.org>
---
 kernel/cgroup/cgroup.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5287,6 +5287,17 @@ static void *cgroup_procs_start(struct s

 static int cgroup_procs_show(struct seq_file *s, void *v)
 {
+	pid_t pid = task_pid_vnr(v);
+
+	/*
+	 * css_task_iter_next() could have visited a task which has already lost
+	 * its PID but is not dead yet or the task could have been unhashed
+	 * since css_task_iter_next(). In such cases, $pid would be 0 here.
+	 * Don't confuse userspace with it.
+	 */
+	if (unlikely(!pid))
+		return SEQ_SKIP;
+
 	seq_printf(s, "%d\n", task_pid_vnr(v));
 	return 0;
 }