| From e6a59aac8a8713f335a37d762db0dbe80e7f6d38 Mon Sep 17 00:00:00 2001 |
| From: Davidlohr Bueso <dave@stgolabs.net> |
| Date: Fri, 10 Dec 2021 10:20:58 -0800 |
| Subject: block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) |
| |
| From: Davidlohr Bueso <dave@stgolabs.net> |
| |
| commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream. |
| |
| do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent |
| change_pid(PIDTYPE_PGID) that can move the task from one hlist |
| to another while iterating. Serialize ioprio_get to take |
| the tasklist_lock in this case, just like it's set counterpart. |
| |
| Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}()) |
| Acked-by: Oleg Nesterov <oleg@redhat.com> |
| Signed-off-by: Davidlohr Bueso <dbueso@suse.de> |
| Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| block/ioprio.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/block/ioprio.c |
| +++ b/block/ioprio.c |
| @@ -202,6 +202,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, |
| pgrp = task_pgrp(current); |
| else |
| pgrp = find_vpid(who); |
| + read_lock(&tasklist_lock); |
| do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { |
| tmpio = get_task_ioprio(p); |
| if (tmpio < 0) |
| @@ -211,6 +212,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, |
| else |
| ret = ioprio_best(ret, tmpio); |
| } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); |
| + read_unlock(&tasklist_lock); |
| + |
| break; |
| case IOPRIO_WHO_USER: |
| uid = make_kuid(current_user_ns(), who); |