From: Eric W. Biederman Every call to is_orphaned_pgrp passed in process_group(current) which is racy with respect to another thread changing our process group. It didn't bite us because we were dealing with integers and the worse we would get would be a stale answer. In switching the checks to use struct pid to be a little more efficient and prepare the way for pid namespaces this race became apparent. So I simplified the calls to the more specialized is_current_pgrp_orphaned so I didn't have to worry about making logic changes to avoid the race. Signed-off-by: Eric W. Biederman Cc: Alan Cox Cc: Oleg Nesterov Signed-off-by: Andrew Morton --- drivers/char/n_tty.c | 2 +- drivers/char/tty_io.c | 2 +- include/linux/tty.h | 2 +- kernel/exit.c | 4 ++-- kernel/signal.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff -puN drivers/char/n_tty.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned drivers/char/n_tty.c --- a/drivers/char/n_tty.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned +++ a/drivers/char/n_tty.c @@ -1188,7 +1188,7 @@ static int job_control(struct tty_struct printk("read_chan: tty->pgrp <= 0!\n"); else if (process_group(current) != tty->pgrp) { if (is_ignored(SIGTTIN) || - is_orphaned_pgrp(process_group(current))) + is_current_pgrp_orphaned()) return -EIO; kill_pg(process_group(current), SIGTTIN, 1); return -ERESTARTSYS; diff -puN drivers/char/tty_io.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned drivers/char/tty_io.c --- a/drivers/char/tty_io.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned +++ a/drivers/char/tty_io.c @@ -1118,7 +1118,7 @@ int tty_check_change(struct tty_struct * return 0; if (is_ignored(SIGTTOU)) return 0; - if (is_orphaned_pgrp(process_group(current))) + if (is_current_pgrp_orphaned()) return -EIO; (void) kill_pg(process_group(current), SIGTTOU, 1); return -ERESTARTSYS; diff -puN include/linux/tty.h~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned include/linux/tty.h --- a/include/linux/tty.h~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned +++ a/include/linux/tty.h @@ -303,7 +303,7 @@ extern int tty_read_raw_data(struct tty_ int buflen); extern void tty_write_message(struct tty_struct *tty, char *msg); -extern int is_orphaned_pgrp(int pgrp); +extern int is_current_pgrp_orphaned(void); extern int is_ignored(int sig); extern int tty_signal(int sig, struct tty_struct *tty); extern void tty_hangup(struct tty_struct * tty); diff -puN kernel/exit.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned kernel/exit.c --- a/kernel/exit.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned +++ a/kernel/exit.c @@ -229,12 +229,12 @@ static int will_become_orphaned_pgrp(str return ret; /* (sighing) "Often!" */ } -int is_orphaned_pgrp(int pgrp) +int is_current_pgrp_orphaned(void) { int retval; read_lock(&tasklist_lock); - retval = will_become_orphaned_pgrp(find_pid(pgrp), NULL); + retval = will_become_orphaned_pgrp(task_pgrp(current), NULL); read_unlock(&tasklist_lock); return retval; diff -puN kernel/signal.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned kernel/signal.c --- a/kernel/signal.c~pid-replace-is_orphaned_pgrp-with-is_current_pgrp_orphaned +++ a/kernel/signal.c @@ -1909,7 +1909,7 @@ relock: /* signals can be posted during this window */ - if (is_orphaned_pgrp(process_group(current))) + if (is_current_pgrp_orphaned()) goto relock; spin_lock_irq(¤t->sighand->siglock); _