pid: document the PIDNS_ADDING checks in alloc_pid() and copy_process()

Both copy_process() and alloc_pid() do the same PIDNS_ADDING check.  The
reasons for these checks, and the fact that both are necessary, are not
immediately obvious.  Add the comments.

Link: https://lkml.kernel.org/r/aaGIRElc78U4Er42@redhat.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: Adrian Reber <areber@redhat.com>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Cc: Alexander Mikhalitsyn <alexander@mihalicyn.com>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Kirill Tkhai <tkhai@ya.ru>
Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/kernel/fork.c b/kernel/fork.c
index db02a301d0c0af3d3aa3b0f5d50798e1e0cf45d7..1e80d4cdf538380b7b2c95f5450fec486e9cb679 100644 (file)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2393,7 +2393,11 @@ __latent_entropy struct task_struct *copy_process(
 
        rseq_fork(p, clone_flags);
 
-       /* Don't start children in a dying pid namespace */
+       /*
+        * If zap_pid_ns_processes() was called after alloc_pid(), the new
+        * child missed SIGKILL.  If current is not in the same namespace,
+        * we can't rely on fatal_signal_pending() below.
+        */
        if (unlikely(!(ns_of_pid(pid)->pid_allocated & PIDNS_ADDING))) {
                retval = -ENOMEM;
                goto bad_fork_core_free;

diff --git a/kernel/pid.c b/kernel/pid.c
index aff5bf0f638f8b7494125b7c50ed5d989870da35..2f1dbcbc2349afc6090c9c987368752aa43dd2dc 100644 (file)
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -314,6 +314,11 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *arg_set_tid,
         *
         * This can't be done earlier because we need to preserve other
         * error conditions.
+        *
+        * We need this even if copy_process() does the same check. If two
+        * or more tasks from parent namespace try to inject a child into a
+        * dead namespace, one of free_pid() calls from the copy_process()
+        * error path may try to wakeup the possibly freed ns->child_reaper.
         */
        retval = -ENOMEM;
        if (unlikely(!(ns->pid_allocated & PIDNS_ADDING)))