diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2018-01-03 11:03:07 -0800 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-01-03 11:03:07 -0800 |
commit | d6bbd51587ecd173958453969964fb41140b1540 (patch) | |
tree | 82c2cdac5cdec9ce9904f470cccb41dad217d680 /kernel | |
parent | 50d0f78f5c736e974188d72bf9317971e37e69b0 (diff) | |
parent | c0ee554906c3d6554fbddf95ae664cd9f817082b (diff) | |
download | op-kernel-dev-d6bbd51587ecd173958453969964fb41140b1540.zip op-kernel-dev-d6bbd51587ecd173958453969964fb41140b1540.tar.gz |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
Pull pid allocation bug fix from Eric Biederman:
"The replacement of the pid hash table and the pid bitmap with an idr
resulted in an implementation that now fails more often in low memory
situations. Allowing fuzzers to observe bad behavior from a memory
allocation failure during pid allocation.
This is a small change to fix this by making the kernel more robust in
the case of error. The non-error paths are left alone so the only
danger is to the already broken error path. I have manually injected
errors and verified that this new error handling works"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
pid: Handle failure to allocate the first pid in a pid namespace
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/pid.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/kernel/pid.c b/kernel/pid.c index b13b624..1e8bb65 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -193,10 +193,8 @@ struct pid *alloc_pid(struct pid_namespace *ns) } if (unlikely(is_child_reaper(pid))) { - if (pid_ns_prepare_proc(ns)) { - disable_pid_allocation(ns); + if (pid_ns_prepare_proc(ns)) goto out_free; - } } get_pid_ns(ns); @@ -226,6 +224,10 @@ out_free: while (++i <= ns->level) idr_remove(&ns->idr, (pid->numbers + i)->nr); + /* On failure to allocate the first pid, reset the state */ + if (ns->pid_allocated == PIDNS_ADDING) + idr_set_cursor(&ns->idr, 0); + spin_unlock_irq(&pidmap_lock); kmem_cache_free(ns->pid_cachep, pid); |