[lkml]   [2018]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.4 016/190] pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
4.4-stable review patch.  If anyone has any objections, please let me know.


From: Kirill Tkhai <>

[ Upstream commit 8896c23d2ef803f1883fea73117a435925c2b4c4 ]

alloc_pidmap() advances pid_namespace::last_pid. When first pid
allocation fails, then next created process will have pid 2 and
pid_ns_prepare_proc() won't be called. So, pid_namespace::proc_mnt will
never be initialized (not to mention that there won't be a child

I saw crash stack of such case on kernel 3.10:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: proc_flush_task+0x8f/0x1b0
Call Trace:

We may fix this by restore of last_pid in 0 or by prohibiting of futher
allocations. Since there was a similar issue in Oleg Nesterov's commit
314a8ad0f18a ("pidns: fix free_pid() to handle the first fork failure").
and it was fixed via prohibiting allocation, let's follow this way, and
do the same.

Signed-off-by: Kirill Tkhai <>
Acked-by: Cyrill Gorcunov <>
Cc: Andrei Vagin <>
Cc: Andreas Gruenbacher <>
Cc: Kees Cook <>
Cc: Michael Kerrisk <>
Cc: Al Viro <>
Cc: Oleg Nesterov <>
Cc: Paul Moore <>
Cc: Eric Biederman <>
Cc: Andy Lutomirski <>
Cc: Ingo Molnar <>
Cc: Serge Hallyn <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Sasha Levin <>
Signed-off-by: Greg Kroah-Hartman <>
kernel/pid.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -322,8 +322,10 @@ struct pid *alloc_pid(struct pid_namespa

if (unlikely(is_child_reaper(pid))) {
- if (pid_ns_prepare_proc(ns))
+ if (pid_ns_prepare_proc(ns)) {
+ disable_pid_allocation(ns);
goto out_free;
+ }


 \ /
  Last update: 2018-04-11 23:00    [W:0.512 / U:2.620 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site