[PATCH] simplify/fix first_tid()
first_tid: /* If nr exceeds the number of threads there is nothing todo */ if (nr) { if (nr >= get_nr_threads(leader)) goto done; } This is not reliable: sub-threads can exit after this check, so the 'for' loop below can overlap and proc_task_readdir() can return an already filldir'ed dirents. for (; pos && pid_alive(pos); pos = next_thread(pos)) { if (--nr > 0) continue; Off-by-one error, will return 'leader' when nr == 1. This patch tries to fix these problems and simplify the code. Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
cc288738c9
commit
a872ff0cb2
|
@ -2227,38 +2227,34 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
|
||||||
static struct task_struct *first_tid(struct task_struct *leader,
|
static struct task_struct *first_tid(struct task_struct *leader,
|
||||||
int tid, int nr)
|
int tid, int nr)
|
||||||
{
|
{
|
||||||
struct task_struct *pos = NULL;
|
struct task_struct *pos;
|
||||||
|
|
||||||
rcu_read_lock();
|
rcu_read_lock();
|
||||||
/* Attempt to start with the pid of a thread */
|
/* Attempt to start with the pid of a thread */
|
||||||
if (tid && (nr > 0)) {
|
if (tid && (nr > 0)) {
|
||||||
pos = find_task_by_pid(tid);
|
pos = find_task_by_pid(tid);
|
||||||
if (pos && (pos->group_leader != leader))
|
if (pos && (pos->group_leader == leader))
|
||||||
pos = NULL;
|
goto found;
|
||||||
if (pos)
|
|
||||||
nr = 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/* If nr exceeds the number of threads there is nothing todo */
|
/* If nr exceeds the number of threads there is nothing todo */
|
||||||
if (nr) {
|
|
||||||
if (nr >= get_nr_threads(leader))
|
|
||||||
goto done;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* If we haven't found our starting place yet start with the
|
|
||||||
* leader and walk nr threads forward.
|
|
||||||
*/
|
|
||||||
if (!pos && (nr >= 0))
|
|
||||||
pos = leader;
|
|
||||||
|
|
||||||
for (; pos && pid_alive(pos); pos = next_thread(pos)) {
|
|
||||||
if (--nr > 0)
|
|
||||||
continue;
|
|
||||||
get_task_struct(pos);
|
|
||||||
goto done;
|
|
||||||
}
|
|
||||||
pos = NULL;
|
pos = NULL;
|
||||||
done:
|
if (nr && nr >= get_nr_threads(leader))
|
||||||
|
goto out;
|
||||||
|
|
||||||
|
/* If we haven't found our starting place yet start
|
||||||
|
* with the leader and walk nr threads forward.
|
||||||
|
*/
|
||||||
|
for (pos = leader; nr > 0; --nr) {
|
||||||
|
pos = next_thread(pos);
|
||||||
|
if (pos == leader) {
|
||||||
|
pos = NULL;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
found:
|
||||||
|
get_task_struct(pos);
|
||||||
|
out:
|
||||||
rcu_read_unlock();
|
rcu_read_unlock();
|
||||||
return pos;
|
return pos;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue