Re: [PATCH v2] exit: hold a reference to thread_pid across proc_flush_pid

[Christian Brauner <brauner@kernel.org>]

On Mon, Aug 31, 2026 at 04:58:58PM +0200, Oleg Nesterov wrote:
> On 08/31, Daehyeon Ko wrote:
> >
> > Commit 0a36bad01731 ("release_task: kill the no longer needed
> > get/put_pid(thread_pid)") removed the reference around proc_flush_pid().
> > It assumed that free_pids(post.pids) at the end of release_task() would
> > keep thread_pid alive until then.
> >
> > That assumption is wrong.  __change_pid() only records a detached PID in
> > post.pids when pid_has_task() is false for every PIDTYPE.  If another task
> > still uses the exiting task's PID as its process group or session ID,
> > __unhash_process() removes the exiting task's PIDTYPE_PID link but leaves
> > the PID out of post.pids.  release_task() therefore holds no reference to
> > it after dropping tasklist_lock.
> >
> > The other task can then remove the remaining PIDTYPE links.  Its
> > free_pids() call schedules delayed_put_pid(), and the RCU callback can free
> > the PID before the first release_task() reaches proc_flush_pid().
> 
> Much better, thanks. The comment above get_pid(task_pid(p)) looks better too.
> 
> Acked-by: Oleg Nesterov <oleg@redhat.com>
> 
> 
> > A tested source reproducer is available privately on request.  No
> > controlled read or write, information leak, or privilege escalation is
> > claimed.  The mainline patch applies directly to v6.19.y and newer;
> > v6.16.y through v6.18.y need a context-adjusted backport.
> 
> Up to you and Christian (I am hoping we can take your fix), but I think

Snatching it up, thanks!