From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751140AbdE2Ktv (ORCPT ); Mon, 29 May 2017 06:49:51 -0400 Received: from mail-db5eur01on0101.outbound.protection.outlook.com ([104.47.2.101]:42976 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751096AbdE2Ktt (ORCPT ); Mon, 29 May 2017 06:49:49 -0400 Authentication-Results: hallyn.com; dkim=none (message not signed) header.d=none;hallyn.com; dmarc=none action=none header.from=virtuozzo.com; Subject: Re: [PATCH] pid_ns: Allow to get pid_for_children ns before child_reaper is created To: "Eric W. Biederman" References: <149555694775.4786.18241837604458780213.stgit@localhost.localdomain> <87y3tizhqg.fsf@xmission.com> CC: , , , , , , , , , , From: Kirill Tkhai Message-ID: <8de7d233-b7d3-a63e-4980-eb32e8761c30@virtuozzo.com> Date: Mon, 29 May 2017 13:49:40 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <87y3tizhqg.fsf@xmission.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: AM5PR0402CA0013.eurprd04.prod.outlook.com (2603:10a6:203:90::23) To HE1PR0801MB1339.eurprd08.prod.outlook.com (2603:10a6:3:3a::7) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: HE1PR0801MB1339: X-MS-Office365-Filtering-Correlation-Id: ce457608-0b4e-4871-2604-08d4a6806b3b X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201703131423075)(201703031133081);SRVR:HE1PR0801MB1339; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1339;3:dmEWQxJGPI0DU9mFbS9sqW7gH0Epz7HjfNF7q49L9sB4iJqesIWec2W2TuCNqMm99H0pIcCA7yy9iFC32fnp3isf3wCVexkA+i1iiw9EktSy/SM/JzfQ9p4HV5vYplpzuIhFTPg/ehPiuvgzY/z9j6NUki6kUe+cuyxWC8wgSIGzMrj4BwqaQaC12yqs00kvPlO2+W0Fr2ukvD3raJhyqYN8WT4WthiDYaFcCvm8PouFJAnQup/KIK6IgJOCY3RybkkUEPbQ7ZTeT4GkJPtKD/fF2hbmEuC3kq/c1VtwFxM5ZSEYesc5JhFyi/KwtJqxcUmM+pQtKGl9HK/1X4Oy8A==;25:opgXFRgBFMZE79LCfvroHRmOok56bwQ5/9Eb/z9FmNF5XLXz/MDAGYTGnEhUZSXdy08fOappsGa9KzB9fipcNgET7fPOQtRUDHWossWUyeRZLTn9aaD9Chf4Kniz54uuUOcKt5HiDTXaM60QtzBwI6KhAVnmjMXRIiqg4VmPOOzcOIwklMWJGdE4TEQhDlJnWRF3PgnROTyRlfxyW6/+2Zf7eNu/T5tjF/WYIZpV593xO0JasL8MBO1jlAPL4QHYRC8pTwctZ1lYii94vE9vjAGX4p6XT9wz42HFkK78GboOdMf5mkolDetU/PGutyMc1Bj3bpYZxIEl2eMWi1AsuO3rFgnDyLO/BYb9vlTFrXYh+/izPvAp7sSyB/YHiXmn9GImxV/Z8ss6YIMliD80hiAos9irQe1Gisv/1rXIwCCZY6caTHPk+QGw6EJ9rIwjjZyK3XZB5knOBELcb+Hb2DziTAX7eJ2qwSZQt7bDtd0= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1339;31:NTQ6UuFkwOzEHNrgtKyz64EoCLKde642HkNg0gD3T2eXbK3oBq1uHkxzL0jXTprF34zw3qimmJVjhNWxKtVNrlJAK7k5lPB7rgInZ1Fj1IAr8k3QPkpGEw2tx95EtNnzNkTP2bknIhBUjv3aBkKnT5mK1MdpMwmGN/PZi7/0DlaDgs7D2Wner35F/zoYOx3XJWVvOejsIlTnyGkexhU3yQy9naaL0KR5LRX7zvyWTa0=;20:yFkrDrL2SjgBtUQERQd+eDRZT9qzIhyxD0UivL3ArncaJ0zUpLRywgcFFfsqEkOrVpS69b128pUjYu97IXShqHRe0B6fUqZaxT65shoJjEXy37FN04cTN0ZzjgF8pstA/zyKIRUBR+L4kXZFG5n898FH2VdYW8boI2tyE/JlOg8OVVGMkqI2kgSbgqfgNDs6auUkq13Dw8OhamQN0oLhBA1jh3OMBXrrgBGSaYmjNnBgJpjFjh6Sqrbf3XzN0yuqZohszj6L/gwr4cPY2VWDqWWX2O4FCyZcEHJIS3MEV989AZtCWdiz2UAs8IhcRkgFW6JYOTqnrdXZfTb1cuXT+bThRo3WneU0R4myxmY58+/lqAVx5FSkDwSfrrmQ/44mZfFhEociNYmhE7c4o5OmYNunx+GynlrVyIQFp1xr1vc= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(104084551191319); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700073)(100105000095)(100000701073)(100105300095)(100000702073)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(10201501046)(100000703073)(100105400095)(93006095)(93001095)(3002001)(6041248)(20161123564025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123560025)(20161123562025)(6072148)(100000704073)(100105200095)(100000705073)(100105500095);SRVR:HE1PR0801MB1339;BCL:0;PCL:0;RULEID:(100000800073)(100110000095)(100000801073)(100110300095)(100000802073)(100110100095)(100000803073)(100110400095)(100000804073)(100110200095)(100000805073)(100110500095);SRVR:HE1PR0801MB1339; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtIRTFQUjA4MDFNQjEzMzk7NDpCQnZCZWFWVnNKUElMRlltVWZzR1YrUXdG?= =?utf-8?B?d29EN2JxVHhuVnFrYUhBOG9hVTByS2V3Y2ErNzNETzdXMmtnMHBLM3hNZVQ0?= =?utf-8?B?UUZyT3MvUmJtMTBWdE1Dd2RVZnA2SHRvbGFQQ0U3WHE4eXhURjFNL0FtQkQ1?= =?utf-8?B?alZBT1dURUI4OFJpRlp1eDlrbkRrRXN4cDRHYlViUkNkYjhTQ1NxMTBLc2h5?= =?utf-8?B?d0k4dHMxM0ozNUtrM2NDUkVYQnloclcySlJSQzU1d2NGT0VURUF0ZzEvZzND?= =?utf-8?B?S0ZDdnhDakpPQkt2TEwxejRDRXA3RDdPZU9YT0hYODNybVArMGtKOEJVQlMy?= =?utf-8?B?MUxnVDFIRHcwK0s3c3BWUWQ4RlZkKzhzc0xndXBHTDNTemE4UmpTWUhjbVdw?= =?utf-8?B?VlBQTkxQaVlHNW52RXptdUtBNkZBOWJLNUxmeXdTM1hsVzBhYzZRR0FsV0xF?= =?utf-8?B?dWJiVCtzV3o5VG9nNVZiK2xaY0xmOE5UVDFJT3hES2tpZnhxUWhka2NaSDlP?= =?utf-8?B?aHhJbm5hQTh2b1ZnUndTbytreTNyTlNBUXhQeFp0czVwM0N2RmhtUng2TXNB?= =?utf-8?B?UE1ocmdPaWRFNXVESWRjdHR6eXo5V3dSazNucURmd3VaNUFwUlFXYk5EcEVa?= =?utf-8?B?bVdhbGRuQkxiY3RoMXVDdjVWUFdZYVZRSGlYaHZ4aUdKRE1qeEhUZFZQMTVT?= =?utf-8?B?akI1cnhoYU9pMlV0WVNaSEZQVlIxczBwS2NxcWhaQWlrM0U4SzRxMFo2TXZY?= =?utf-8?B?a0lNZXpDN1lNMXltd09yUWxVMFVxSzBlSXlqNkZOK0xqMFU2OERxV2pVYVMr?= =?utf-8?B?di9IdjRONUlsRzJmN2lnUEJ6Q1lWSHVQcjhKZ2tNWC9neGVRYVFLSTNYOFpE?= =?utf-8?B?SEFyaklOZkVXT2xzMlRDeDdBUTBKcjYrRGNSZFM4NWZoLzdSNENVeFJwZGpU?= =?utf-8?B?VU5LejJFS3d4ZjRRSlIrbzlhNndlYUplbmQvY2R5UFQ2Q0Q0eGlENjd2bytX?= =?utf-8?B?d1BSc1oyTFZJZ3g4RXo2OHpoL0JHOUNPL2U4OW4vZ3V0bEJVRjFvN0tmTDVW?= =?utf-8?B?ZkhWckxOUERLbXJ4OG8zYWdFTmNRWGxNa2YxbUljalE5K0t4NmxHa0VhS1VF?= =?utf-8?B?VmFIc3hSckRETWdPNU15NWdpS2c1Mzd2R2VrY2VvRnhzblE2S3JDSFVSZnBC?= =?utf-8?B?V08xeFVSUFRaQXQ3NG03RVNONGxmZ3ZPcDRWYVhMOXlscE9LY2VxbmFSbFdw?= =?utf-8?B?d1JGOXZpN1ZPRDl4bEgxTkhzbU9DUHplelZmdWpldTBIbWFHVGw5UGlVM2VM?= =?utf-8?B?MEhpUzVjMUNWNXh6TC9MR0l2SFQ2b3B3aUI4SjIyUkJGWGFqQk4yWTBrbUJJ?= =?utf-8?B?QzNmQmpzSW1FdWIvVmtUNm80RFNXNWc4RVNJYkdUYzNQL1RsbXFwNXBhb1hS?= =?utf-8?B?TXdPajR5OXhPUWdXaFlxdFhtK0lmdlh4QTB2akhEVk5BRndZbUNrVkh5M3dN?= =?utf-8?B?ckF6czlmTjV3cDBFNHB6RHN1aTB0WlZLK2g0VDZMM1BuVi9YdldOaVZUeVBm?= =?utf-8?B?dkhDMi9kVDdjdjFUdE12ZkROSnU1a2hsZ29WOXc0aTF0KzFDbjJlOVdoZmZZ?= =?utf-8?Q?=3D?= X-Forefront-PRVS: 0322B4EDE1 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(39450400003)(39410400002)(39400400002)(39830400002)(24454002)(81166006)(23676002)(36756003)(8676002)(53936002)(6486002)(3846002)(77096006)(230700001)(33646002)(2906002)(189998001)(83506001)(86362001)(31696002)(575784001)(4001350100001)(54906002)(76176999)(50986999)(54356999)(4326008)(6666003)(2950100002)(478600001)(47776003)(65826007)(7416002)(6246003)(38730400002)(5660300001)(229853002)(42186005)(6916009)(53546009)(25786009)(7736002)(66066001)(305945005);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0801MB1339;H:[172.16.24.149];FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtIRTFQUjA4MDFNQjEzMzk7MjM6MDV6cCtyS2lWby9oV3hmVytjWmJqUkk1?= =?utf-8?B?c1BnN1NDVjNhNVY4TnU2RzQ3QVhUNTc1UjQvVUI5SlZqVXF4V3JvMFRNbFlu?= =?utf-8?B?d01NZ2MzNDcwN1pEeVZ0N1ZVdHIwbnBBbUFBL1luOFhWWkcrY0Rxa2o2Wkpa?= =?utf-8?B?a1BENDVXYXBCUWc2OUwrWjdWZWdqVGZDMmlVQ001YWY2UUduN0pGTFg3QWpi?= =?utf-8?B?UlA4YzBMVkhHOHdHYmdVdys1cHFjWTBUajFCQTZpRWM3NDA5bzQ3QjkyVWpv?= =?utf-8?B?UVA5U3FHZU9HOVJMQWJnN0swaHZWaGdDN1dBZjZQQ3BXTXVDSXBpNU91clJ3?= =?utf-8?B?L1M0dE9pYnFtM1VSRXl4YjBRcCtjazVpdHhnV3FIN2g1QThEVzQzcTlFR1Aw?= =?utf-8?B?RHA3aEEwLzVKUlFaVWdtSDZUOHlmN1dKTVFsUVRWbTA4RG82N3FqZldjaVBu?= =?utf-8?B?SmNid0ZlNU1hTHFWRUUvOE9VbklkZENoVDRFbmk5OXNPeVdRMWxEL2JVOTVl?= =?utf-8?B?Y21xUEw5UVZJaFdJM3BLU2E1ZC9kcTlJd294bDM1V3JINjI4ZVk2aDcrbUha?= =?utf-8?B?TUQ5NXFER2p3aW95Q29tdDl4OTZyV21BSW1OaFI2aVZmTlFmZSs3elVKOFg5?= =?utf-8?B?NFMwY0lUaTJpamQ3MlNNN0djWFAweG1Wd3lGMXJiM01UNlhJclRjRElUUmJH?= =?utf-8?B?RXlPbHZlS3hTeCtRTGJGUzBmbDUwaVh5Zk54ZXVRYThCMzFUU2tjMkVYY2Jk?= =?utf-8?B?YnVlM1l0ejlEbXFWQ0dKVVhyVklWbEl3MHVmclU2eTA5Yk1HN3hjMUN4OU9a?= =?utf-8?B?dXhvMEc5VDhXaWdBVmE1SWpsV09TaWk3MmpoQUpDRGpEMHdIQTN6cTltRFRQ?= =?utf-8?B?V2lQMHVEbFBGRTFCT3pOL3dMam9xeGhlYysyUUI3a3NIM3NhQnFlUUdrcHI2?= =?utf-8?B?eWw2YlpMRVhDQVFxZ1JURXdtLzlKekFkdW8xR3hxSGVPN0lxaGwyWUI0VFBB?= =?utf-8?B?OVI4MERBNWdrQzkyclJNTG01RGpNaGJiQ0ViNzlNL3p5MWNNUXBNWEVUc2tq?= =?utf-8?B?d25rcVQybkhaWFF4c0F4dTdWTzFaa2FHSDJFZnk0czJaQjIxcHU3bWUwb2ZF?= =?utf-8?B?aVU1azQvaWZ0T0N3dWR4cjlGcThHRkFuQnNJWkRCb3Y2YnIxQTZ1blNveGl3?= =?utf-8?B?Ny81cjRUUGdRTFM1TExuR1Byb1dJVmdlSzdLUS9ySitxTktzQnlPWjIxenlw?= =?utf-8?B?Q1pkWHQyemxpMHUxZ1FFL080ZWRTTld5VXVBWjVRa1FJQ0tYcTZSVkJHR2g2?= =?utf-8?B?RzB3R1FrSE8zeFJ4bld4RnRzMm44K0xWMHo5eEkxUTBNd3NhZzdTY2ZpQVli?= =?utf-8?B?R1NSRnNTLzZIaWI0N0ExMEJrT1VQckdiTmZWcjVHY3pCdUxUY0VlWmhNUitG?= =?utf-8?B?aHQzZUozZGFPeHBZQnNQd0xoeUFXKzRTNWpXWGdsdWtTMWVCTmhqYkxOSVpy?= =?utf-8?B?aGxicVMySUt3OFhYY3J5YlFxblFWUjFPWmwyb3paVXgrdlVVUVc2VmZBNzRM?= =?utf-8?B?N2RGMjJydDVsZWZ3cGcvK0huT2FMQy8zOFc5a08zTUhrQzNnUUdXTGg3YTZZ?= =?utf-8?Q?8=3D?= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1339;6:iXielsIBXdYNJyKOQhoOjftJQXJ4WJkVNx7BrKoCa69ItvPlf116RjZs3uXO9yL2P0pth8DLa/EDon0Hj6POizIzbviRheBpW8PsBg5L0N4TYL96H1B5c4HImlrpJPFSfjTs672+0pR3tVmZBM5/OmunPItcPqlNFzoXJosKOEDixaqUgTOZtUyLZxk2G8G4y6Q9k7zqF3kFmLZPpyibKezFcQ4+ehK1pJXsZsHYhiYBhGGwOxA5piAZFNAXA9odY9f0tybTV1zMrmWOur7Pp2GiViJt1kDjJ4Ln5x1A8tddnM8r7taAhh6RtTzEUFCRfB8hnUdii/S9jC1MMp92Gpmbi+7kbRW12Thc/8JvvwQnKdF9TFxaQz4yFjDYGaE3sLmFI1P3j5KRKMVgcYzsl0HrEan130q2fDLglOonEpQ8JUWBsdBpG1QCUuBRKNgWSvTprSC/luyUZfpU8BdnIy2EtVP7hhrWSMRyCoFnh6oyHET/GvadNW1H+nw5HcYM02ZJnDwV8joYeBnt+dKCPw== X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1339;5:C2Jad5DRjNhrkeM3+HoIn/RbBC5RZIQCBYoABgrSEB+C861RLMoaPJT87BOdKoHBaRWIX5AUhurxh4Aly8/pZHwSct/rgZlngVN1cG/s72SwGjr31s7LhAx2O1RArF+RCLUdl92LvtZDiX5hkfn0Znw0Gddx6O6dxXjP63tqCfiyei9xxOKme1+E3tmPhBDEi88f6ca8toUKKa7IuLNe/oGuGWt554d5d/NxWiZBtb2VkxskEcBHz9d1FqjEDnak92QYB13z3pAnYL+HoOsrp2jPihAyVydzLtNkkKPLfLANA+BRhymLhVNLw7FZCHZNx+Exkbo15cuVAEvPgPJEjJSCeY6O7wDMGF7Uq9/Wo0r9l9Wz74k7tAWOCLUptdUD7Ya/hXyekZDc27DUYCXySkYdsk69O+Ud1lzzbSernfhuIQKrtHGmQLi/0NM338ZB+diE281DVXA3+Tz53Pjb2BXXEJTrsx2xJkKK32f+OdNOr1NK6FUhu9OX1ZrH8C5B;24:DdG51Rs6lVGa5B3zFaIo9KuOi1xwF62DnYgRM1dC58jo4j3shEuhpXXOobzB9Bo+ZqBF4w7JbECqF25VZlze48wPYS4TfAPiMQrjJ6I7XhI= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1339;7:/ztfeHw8nM9n4wgenmKCZyC6lgx+TPSc7yel4HxRUkuNaB6mRrCbNTQoCrneAhQTktB+KJsZpQ7a+bixG21Kgk5BMVCmCcKSWDcqJ1EmXhWwBppCtqdVYdZRSdSmlyXN3dN52jSJ6sN+4VxziIbl0EFhJsU2e7qemOyfUXZ0Zzk9VnJPyxenbhWMLF0Wxer8cASn1i/r5Dqhn8ES6zS7QxNSWUjTPBXC20C9461PUoT/Au8oip/i2ThS8FjBM8n8xsdcjl8kTGAbPJtKjjsE5ykoP31kbflUtbKHmAU2uNh7pD5XhU5e+WoZlpaF8pbmfsUXHQ/FRL8bo4aevBXFJQ==;20:Q5oQZQ0/n9u5+Z7oVg4BjOdNT54CflUqtuUQ37h+CqstdEXBrSNv1S9WX2P4eBBDzQIMupXZIFQZBve0dtCNzAYuEAmgS3aYYlaxLNSQ4LfzaTZc9vHLRBTty37mFBkoCJywE8Z3GHskG3rx0eYBjn9jJW8dej1nSSgwdLywoBI= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 May 2017 10:49:44.0169 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1339 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 27.05.2017 14:01, Eric W. Biederman wrote: > Kirill Tkhai writes: > >> This patch prohibits pid allocation till child_reaper >> of pid namespace is set, and it makes possible and safe >> to get just unshared pid_ns from "/proc/[pid]/ns/pid_for_children" >> file. This may be useful to determine user_ns of such a created >> pid_ns, which is not possible now. >> >> It was prohibited till now, because the architecture of pid namespaces >> assumes child reaper is the firstly created process of the namespace, >> and it initializes pid_namespace::proc_mnt. Child reaper creation >> mustn't race with creation of another processes from this namespace, >> otherwise a process with pid > 1 may die before pid_namespace::proc_mnt >> is populated and it will get a null pointer dereference in proc_flush_task(). >> Also, child reaper mustn't die before processes from the namespace. > > This patch introduces the possibility that two or more processes may > have the same pid namespace (with no processes) as pid_ns_for_children. > > Which means you can now have a race for the first pid in alloc_pid. > Making it indeterminant who allocates the init process. Which is not > acceptable. > > It is not acceptable on two grounds. > 1) It is a bogus user space semantic. Because userspace needs to > know who allocates init. > 2) It is horrible for maintenance becuase now the code has to be very > clever to deal with a case that no one cares about. Which is > a general formula for buggy code. We may disallow setns() if there is no child reaper created, and this solves all above issues. Please see v2 below, it has no problems you pointed. [PATCH v2]pid_ns: Allow to get pid_for_children ns before child_reaper is created This patch prohibits setns() on a pid namespace till its child_reaper is set, and it makes possible and safe to get just unshared pid_ns from "/proc/[pid]/ns/pid_for_children" file. This may be useful to determine user_ns of such a created pid_ns, which is not possible now. It was not possible till now, because the architecture of pid namespaces assumes child reaper is the first created process of the namespace, and it initializes pid_namespace::proc_mnt. Child reaper creation mustn't race with creation of another processes from this namespace, otherwise a process with pid > 1 may die before pid_namespace::proc_mnt is populated and it will get a null pointer dereference in proc_flush_task(). Also, child reaper mustn't die before processes from the namespace. The patch prevents such races. It allows to setns() on a pid namespace only if ns->child_reaper is already set, and this guarantees, that only pid namespace creator may establish child reaper. So, we can safely allow to get "/proc/[pid]/ns/pid_for_children" since it's created, and to analyse it. v2: Don't race for child reaper creation. Signed-off-by: Kirill Tkhai CC: Andrew Morton CC: "Eric W. Biederman" CC: Oleg Nesterov CC: Andy Lutomirski CC: Serge Hallyn CC: Michal Hocko CC: Andrei Vagin CC: Cyrill Gorcunov CC: Mike Rapoport CC: Ingo Molnar CC: Peter Zijlstra --- kernel/pid_namespace.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index 74a5a7255b4d..5e7b3fd0d4c2 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -385,15 +385,6 @@ static struct ns_common *pidns_for_children_get(struct task_struct *task) } task_unlock(task); - if (ns) { - read_lock(&tasklist_lock); - if (!ns->child_reaper) { - put_pid_ns(ns); - ns = NULL; - } - read_unlock(&tasklist_lock); - } - return ns ? &ns->ns : NULL; } @@ -428,6 +419,15 @@ static int pidns_install(struct nsproxy *nsproxy, struct ns_common *ns) if (ancestor != active) return -EINVAL; + /* + * Disallow processes to use pid namespace till its + * creator makes child reaper. Otherwise, several + * processes race for that, and it's not clear who + * establishes init. + */ + if (!new->child_reaper) + return -ESRCH; + put_pid_ns(nsproxy->pid_ns_for_children); nsproxy->pid_ns_for_children = get_pid_ns(new); return 0;