From: Oleg Nesterov Based on Eric W. Biederman's idea. Without tasklist_lock held task_session()/task_pgrp() can return NULL if the caller races with setprgp()/setsid() which does detach_pid() + attach_pid(). This can happen even if task == current. Intoduce the new helper, change_pid(), which should be used instead. This way the caller always sees the special pid != NULL, either old or new. Also change the prototype of attach_pid(), it always returns 0 and nobody check the returned value. Signed-off-by: Oleg Nesterov Cc: "Eric W. Biederman" Cc: Pavel Emelyanov Cc: Roland McGrath Signed-off-by: Andrew Morton --- include/linux/pid.h | 6 ++++-- kernel/pid.c | 21 ++++++++++++++++----- 2 files changed, 20 insertions(+), 7 deletions(-) diff -puN include/linux/pid.h~pids-introduce-change_pid-helper include/linux/pid.h --- a/include/linux/pid.h~pids-introduce-change_pid-helper +++ a/include/linux/pid.h @@ -89,9 +89,11 @@ extern struct pid *get_task_pid(struct t * attach_pid() and detach_pid() must be called with the tasklist_lock * write-held. */ -extern int attach_pid(struct task_struct *task, enum pid_type type, - struct pid *pid); +extern void attach_pid(struct task_struct *task, enum pid_type type, + struct pid *pid); extern void detach_pid(struct task_struct *task, enum pid_type); +extern void change_pid(struct task_struct *task, enum pid_type, + struct pid *pid); extern void transfer_pid(struct task_struct *old, struct task_struct *new, enum pid_type); diff -puN kernel/pid.c~pids-introduce-change_pid-helper kernel/pid.c --- a/kernel/pid.c~pids-introduce-change_pid-helper +++ a/kernel/pid.c @@ -318,7 +318,7 @@ EXPORT_SYMBOL_GPL(find_pid); /* * attach_pid() must be called with the tasklist_lock write-held. */ -int attach_pid(struct task_struct *task, enum pid_type type, +void attach_pid(struct task_struct *task, enum pid_type type, struct pid *pid) { struct pid_link *link; @@ -326,11 +326,10 @@ int attach_pid(struct task_struct *task, link = &task->pids[type]; link->pid = pid; hlist_add_head_rcu(&link->node, &pid->tasks[type]); - - return 0; } -void detach_pid(struct task_struct *task, enum pid_type type) +static void __change_pid(struct task_struct *task, enum pid_type type, + struct pid *new) { struct pid_link *link; struct pid *pid; @@ -340,7 +339,7 @@ void detach_pid(struct task_struct *task pid = link->pid; hlist_del_rcu(&link->node); - link->pid = NULL; + link->pid = new; for (tmp = PIDTYPE_MAX; --tmp >= 0; ) if (!hlist_empty(&pid->tasks[tmp])) @@ -349,6 +348,18 @@ void detach_pid(struct task_struct *task free_pid(pid); } +void detach_pid(struct task_struct *task, enum pid_type type) +{ + __change_pid(task, type, NULL); +} + +void change_pid(struct task_struct *task, enum pid_type type, + struct pid *pid) +{ + __change_pid(task, type, pid); + attach_pid(task, type, pid); +} + /* transfer_pid is an optimization of attach_pid(new), detach_pid(old) */ void transfer_pid(struct task_struct *old, struct task_struct *new, enum pid_type type) _