diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-08 17:48:18 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-08 17:48:17 -0800 |
| commit | 0c9dc102d9ad614db425c8dbadbfa81d73964ea6 (patch) | |
| tree | d69857e1d7835b9f54443a2e090344053d78774d /kernel | |
| parent | 8c3934fc8457a4774a0bb5865c5ecb1fc128e11b (diff) | |
| parent | 5cbee2fa5de964083d6d9a2d4898615227393a9d (diff) | |
Merge "Use after free from pid_nr_ns()"
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/pid.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/kernel/pid.c b/kernel/pid.c index 78b3d9f80d44..b17263be9082 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -526,8 +526,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, if (!ns) ns = task_active_pid_ns(current); if (likely(pid_alive(task))) { - if (type != PIDTYPE_PID) + if (type != PIDTYPE_PID) { + if (type == __PIDTYPE_TGID) + type = PIDTYPE_PID; task = task->group_leader; + } nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns); } rcu_read_unlock(); @@ -536,12 +539,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, } EXPORT_SYMBOL(__task_pid_nr_ns); -pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns) -{ - return pid_nr_ns(task_tgid(tsk), ns); -} -EXPORT_SYMBOL(task_tgid_nr_ns); - struct pid_namespace *task_active_pid_ns(struct task_struct *tsk) { return ns_of_pid(task_pid(tsk)); |