commit 1a657f78dcc8ea7c53eaa1f2a45ea2315738c15f
author Oleg Nesterov <oleg@tv-sign.ru> Mon Oct 02 02:18:59 2006 -0700
committer Linus Torvalds <torvalds@g5.osdl.org> Mon Oct 02 07:57:25 2006 -0700
tree a19972027792082fed505c8d540f7d877e37c0ab
parent 1c0d04c9e44f4a248335c33d2be7c7f7b06ff359

[PATCH] introduce get_task_pid() to fix unsafe get_pid()

proc_pid_make_inode:

	ei->pid = get_pid(task_pid(task));

I think this is not safe.  get_pid() can be preempted after checking "pid
!= NULL".  Then the task exits, does detach_pid(), and RCU frees the pid.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

fs/proc/base.c

diff --git a/fs/proc/base.c b/fs/proc/base.c
index a317eb2..82da55b 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -958,7 +958,7 @@
 	/*
 	 * grab the reference to task.
 	 */
-	ei->pid = get_pid(task_pid(task));
+	ei->pid = get_task_pid(task, PIDTYPE_PID);
 	if (!ei->pid)
 		goto out_unlock;
 
@@ -1677,7 +1677,7 @@
 	/*
 	 * grab the reference to the task.
 	 */
-	ei->pid = get_pid(task_pid(task));
+	ei->pid = get_task_pid(task, PIDTYPE_PID);
 	if (!ei->pid)
 		goto out_iput;