• Kirill Tkhai's avatar
    pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() · 8896c23d
    Kirill Tkhai authored
    alloc_pidmap() advances pid_namespace::last_pid.  When first pid
    allocation fails, then next created process will have pid 2 and
    pid_ns_prepare_proc() won't be called.  So, pid_namespace::proc_mnt will
    never be initialized (not to mention that there won't be a child
    reaper).
    
    I saw crash stack of such case on kernel 3.10:
    
        BUG: unable to handle kernel NULL pointer dereference at (null)
        IP: proc_flush_task+0x8f/0x1b0
        Call Trace:
            release_task+0x3f/0x490
            wait_consider_task.part.10+0x7ff/0xb00
            do_wait+0x11f/0x280
            SyS_wait4+0x7d/0x110
    
    We may fix this by restore of last_pid in 0 or by prohibiting of futher
    allocations.  Since there was a similar issue in Oleg Nesterov's commit
    314a8ad0 ("pidns: fix free_pid() to handle the first fork failure").
    and it was fixed via prohibiting allocation, let's follow this way, and
    do the same.
    
    Link: http://lkml.kernel.org/r/149201021004.4863.6762095011554287922.stgit@localhost.localdomainSigned-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
    Acked-by: default avatarCyrill Gorcunov <gorcunov@openvz.org>
    Cc: Andrei Vagin <avagin@virtuozzo.com>
    Cc: Andreas Gruenbacher <agruenba@redhat.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Michael Kerrisk <mtk.manpages@googlemail.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Paul Moore <paul@paul-moore.com>
    Cc: Eric Biederman <ebiederm@xmission.com>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Serge Hallyn <serge@hallyn.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    8896c23d
pid.c 15.1 KB