Re: SMP races in proc with thread_struct

From: Todd Inglett (tinglett@vnet.ibm.com)
Date: Fri May 04 2001 - 10:18:47 EST


Andreas Ferber wrote:
>
> On Fri, May 04, 2001 at 10:46:43PM +1000, Keith Owens wrote:
>
> > For a read only case, the only important
> > thing is not to die, one occurrence of bad data is tolerable.
>
> Strong NACK. The pages where the bad data comes from may in some cases
> already be reclaimed for other data, probably something security
> relevant, which should never ever be given even read access by an
> unauthorized user. Even if this event may be a very rare case, one
> single occurrence of this is one to much.

Agreed. Worse, it is not readonly. The /proc code task_lock's the task
struct, thus writing to it.

I'll post a patch shortly once I've tested it. Worse case only if the
task is exiting I sweep the tasklist looking for the parent to see if
the parent is still valid. I am not verifying if it is the actual
parent (it might be a new task allocated at the same spot). I could
just report 0 (or 1) for the parent for any process that is exiting, but
then you won't be able to see the ppid for zombies. Or is there another
state I can look for? What I really need is PF_EXITED :).

I am a little concerned also about mm, file, tty and sig fields. These
appear to be NULLed in do_exit(), but I haven't tracked down tty and sig
yet.

-- 
-todd
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Mon May 07 2001 - 21:00:22 EST