Re: [PATCH v2 2/4] net, pidfs: prepare for handing out pidfds for reaped sk->sk_peer_pid

[Kuniyuki Iwashima]

From: Christian Brauner <brauner@xxxxxxxxxx>
Date: Fri, 25 Apr 2025 10:11:31 +0200
> SO_PEERPIDFD currently doesn't support handing out pidfds if the
> sk->sk_peer_pid thread-group leader has already been reaped. In this
> case it currently returns EINVAL. Userspace still wants to get a pidfd
> for a reaped process to have a stable handle it can pass on.
> This is especially useful now that it is possible to retrieve exit
> information through a pidfd via the PIDFD_GET_INFO ioctl()'s
> PIDFD_INFO_EXIT flag.
> 
> Another summary has been provided by David in [1]:
> 
> > A pidfd can outlive the task it refers to, and thus user-space must
> > already be prepared that the task underlying a pidfd is gone at the time
> > they get their hands on the pidfd. For instance, resolving the pidfd to
> > a PID via the fdinfo must be prepared to read `-1`.
> >
> > Despite user-space knowing that a pidfd might be stale, several kernel
> > APIs currently add another layer that checks for this. In particular,
> > SO_PEERPIDFD returns `EINVAL` if the peer-task was already reaped,
> > but returns a stale pidfd if the task is reaped immediately after the
> > respective alive-check.
> >
> > This has the unfortunate effect that user-space now has two ways to
> > check for the exact same scenario: A syscall might return
> > EINVAL/ESRCH/... *or* the pidfd might be stale, even though there is no
> > particular reason to distinguish both cases. This also propagates
> > through user-space APIs, which pass on pidfds. They must be prepared to
> > pass on `-1` *or* the pidfd, because there is no guaranteed way to get a
> > stale pidfd from the kernel.
> > Userspace must already deal with a pidfd referring to a reaped task as
> > the task may exit and get reaped at any time will there are still many
> > pidfds referring to it.
> 
> In order to allow handing out reaped pidfd SO_PEERPIDFD needs to ensure
> that PIDFD_INFO_EXIT information is available whenever a pidfd for a
> reaped task is created by PIDFD_INFO_EXIT. The uapi promises that reaped
> pidfds are only handed out if it is guaranteed that the caller sees the
> exit information:
> 
> TEST_F(pidfd_info, success_reaped)
> {
>         struct pidfd_info info = {
>                 .mask = PIDFD_INFO_CGROUPID | PIDFD_INFO_EXIT,
>         };
> 
>         /*
>          * Process has already been reaped and PIDFD_INFO_EXIT been set.
>          * Verify that we can retrieve the exit status of the process.
>          */
>         ASSERT_EQ(ioctl(self->child_pidfd4, PIDFD_GET_INFO, &info), 0);
>         ASSERT_FALSE(!!(info.mask & PIDFD_INFO_CREDS));
>         ASSERT_TRUE(!!(info.mask & PIDFD_INFO_EXIT));
>         ASSERT_TRUE(WIFEXITED(info.exit_code));
>         ASSERT_EQ(WEXITSTATUS(info.exit_code), 0);
> }
> 
> To hand out pidfds for reaped processes we thus allocate a pidfs entry
> for the relevant sk->sk_peer_pid at the time the sk->sk_peer_pid is
> stashed and drop it when the socket is destroyed. This guarantees that
> exit information will always be recorded for the sk->sk_peer_pid task
> and we can hand out pidfds for reaped processes.
> 
> Link: https://lore.kernel.org/lkml/20230807085203.819772-1-david@xxxxxxxxxxxx [1]
> Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>

Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>