[TEST PATCH] pid: fix allocating pid 2 for init (was Re: proc_flush_task oops)

[Alexey Dobriyan]

On Fri, Dec 22, 2017 at 08:41:54AM -0600, Eric W. Biederman wrote:
> Alexey Dobriyan <adobri...@gmail.com> writes:

> > unshare
> > fork
> >     alloc_pid in level 1 succeeds
> >     alloc_pid in level 0 fails, ->idr_next is 2
> > fork
> >     alloc pid 2
> > exit
> >
> > Reliable reproducer and fail injection patch attached
> >
> > I'd say proper fix is allocating pids in the opposite order
> > so that failure in the last layer doesn't move IDR cursor
> > in baby child pidns.
> 
> I agree with you about changing the order.  That will make
> the code simpler and in the second loop actually conforming C code,
> and fix the immediate problem.

Something like that (barely tested)

---

 include/linux/pid_namespace.h |    2 ++
 kernel/pid.c                  |   15 +++++++++++----
 kernel/pid_namespace.c        |    3 ---
 3 files changed, 13 insertions(+), 7 deletions(-)

--- a/include/linux/pid_namespace.h
+++ b/include/linux/pid_namespace.h
@@ -28,6 +28,8 @@ struct pid_namespace {
        unsigned int pid_allocated;
        struct task_struct *child_reaper;
        struct kmem_cache *pid_cachep;
+/* MAX_PID_NS_LEVEL is needed for limiting size of 'struct pid' */
+#define MAX_PID_NS_LEVEL 32
        unsigned int level;
        struct pid_namespace *parent;
 #ifdef CONFIG_PROC_FS
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -146,6 +146,7 @@ void free_pid(struct pid *pid)
 
 struct pid *alloc_pid(struct pid_namespace *ns)
 {
+       struct pid_namespace *pid_ns[MAX_PID_NS_LEVEL + 1];
        struct pid *pid;
        enum pid_type type;
        int i, nr;
@@ -157,12 +158,19 @@ struct pid *alloc_pid(struct pid_namespace *ns)
        if (!pid)
                return ERR_PTR(retval);
 
-       tmp = ns;
        pid->level = ns->level;
 
-       for (i = ns->level; i >= 0; i--) {
+       tmp = ns;
+       do {
+               pid_ns[tmp->level] = tmp;
+               tmp = tmp->parent;
+       } while (tmp->level != 0);
+
+       for (i = 0; i <= ns->level; i++) {
                int pid_min = 1;
 
+               tmp = pid_ns[i];
+
                idr_preload(GFP_KERNEL);
                spin_lock_irq(&pidmap_lock);
 
@@ -189,7 +197,6 @@ struct pid *alloc_pid(struct pid_namespace *ns)
 
                pid->numbers[i].nr = nr;
                pid->numbers[i].ns = tmp;
-               tmp = tmp->parent;
        }
 
        if (unlikely(is_child_reaper(pid))) {
@@ -223,7 +230,7 @@ struct pid *alloc_pid(struct pid_namespace *ns)
 
 out_free:
        spin_lock_irq(&pidmap_lock);
-       while (++i <= ns->level)
+       while (--i >= 0)
                idr_remove(&ns->idr, (pid->numbers + i)->nr);
 
        spin_unlock_irq(&pidmap_lock);
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -80,9 +80,6 @@ static void proc_cleanup_work(struct work_struct *work)
        pid_ns_release_proc(ns);
 }
 
-/* MAX_PID_NS_LEVEL is needed for limiting size of 'struct pid' */
-#define MAX_PID_NS_LEVEL 32
-
 static struct ucounts *inc_pid_namespaces(struct user_namespace *ns)
 {
        return inc_ucount(ns, current_euid(), UCOUNT_PID_NAMESPACES);