fanotify: allow reporting pidfds for reaped tasks

Fanotify used to refuse to report pidfds for reaped tasks by applying a
pid_has_task() check before calling pidfd_prepare(). This prevented
userspace from obtaining information about the task.

Register the event pid with pidfs when creating the fanotify event if
pidfd reporting was requested, so pidfd_prepare() can later create a
pidfd for the reaped task.

Suggested-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/linux-fsdevel/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/
Signed-off-by: AnonymeMeow <anonymemeow@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Link: https://patch.msgid.link/20260607003343.425939-3-anonymemeow@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 8ed77901db57ce756971239f0b255e5320ef7e25..a3555bebad63e273ea5c2c2afc2e93ab0580f37a 100644 (file)
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -14,6 +14,7 @@
 #include <linux/sched/mm.h>
 #include <linux/statfs.h>
 #include <linux/stringhash.h>
+#include <linux/pidfs.h>
 
 #include "fanotify.h"
 
@@ -839,6 +840,15 @@ static struct fanotify_event *fanotify_alloc_event(
        /* Whoever is interested in the event, pays for the allocation. */
        old_memcg = set_active_memcg(group->memcg);
 
+       if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
+               pid = task_pid(current);
+       else
+               pid = task_tgid(current);
+
+       if (FAN_GROUP_FLAG(group, FAN_REPORT_PIDFD) &&
+           pidfs_register_pid_gfp(pid, gfp))
+               goto out;
+
        if (fanotify_is_perm_event(mask)) {
                event = fanotify_alloc_perm_event(data, data_type, gfp);
        } else if (fanotify_is_error_event(mask)) {
@@ -860,15 +870,10 @@ static struct fanotify_event *fanotify_alloc_event(
        if (!event)
                goto out;
 
-       if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
-               pid = get_pid(task_pid(current));
-       else
-               pid = get_pid(task_tgid(current));
-
        /* Mix event info, FAN_ONDIR flag and pid into event merge key */
        hash ^= hash_long((unsigned long)pid | ondir, FANOTIFY_EVENT_HASH_BITS);
        fanotify_init_event(event, hash, mask);
-       event->pid = pid;
+       event->pid = get_pid(pid);
 
 out:
        set_active_memcg(old_memcg);

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index ebdd48942029014c1e85fbe841acda1dc2ea6011..b604e3da58ad2e608d02bcc4149cb8baa81e6079 100644 (file)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -904,20 +904,12 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
                metadata.fd = fd >= 0 ? fd : FAN_NOFD;
 
        if (pidfd_mode) {
-               unsigned int tid_mode = FAN_GROUP_FLAG(group, FAN_REPORT_TID);
-               enum pid_type pidtype = tid_mode ? PIDTYPE_PID : PIDTYPE_TGID;
-               unsigned int pidfd_flags = tid_mode ? PIDFD_THREAD : 0;
+               unsigned int pidfd_flags = PIDFD_STALE;
 
-               /*
-                * The pid_has_task() check for an event->pid is performed
-                * preemptively in an attempt to catch out cases where the event
-                * listener reads events after the event generating task has
-                * already terminated.  Depending on flag FAN_REPORT_FD_ERROR,
-                * report either -ESRCH or FAN_NOPIDFD to the event listener in
-                * those cases with all other pidfd creation errors reported as
-                * the error code itself or as FAN_EPIDFD.
-                */
-               if (metadata.pid && pid_has_task(event->pid, pidtype))
+               if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
+                       pidfd_flags |= PIDFD_THREAD;
+
+               if (metadata.pid)
                        pidfd = pidfd_prepare(event->pid, pidfd_flags, &pidfd_file);
 
                if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0)

diff --git a/fs/pidfs.c b/fs/pidfs.c
index 1cce4f34a05128ba7f27bfd217db40c1e14da9a6..15efecf5cb077547840ab0561ea757e95e10eebb 100644 (file)
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -991,14 +991,16 @@ static void pidfs_put_data(void *data)
 }
 
 /**
- * pidfs_register_pid - register a struct pid in pidfs
+ * pidfs_register_pid_gfp - register a struct pid in pidfs with custom GFP
+ * flags
  * @pid: pid to pin
+ * @gfp: GFP flags for memory allocation
  *
- * Register a struct pid in pidfs.
+ * Register a struct pid in pidfs with custom GFP flags.
  *
  * Return: On success zero, on error a negative error code is returned.
  */
-int pidfs_register_pid(struct pid *pid)
+int pidfs_register_pid_gfp(struct pid *pid, gfp_t gfp)
 {
        struct pidfs_attr *new_attr __free(kfree) = NULL;
        struct pidfs_attr *attr;
@@ -1014,7 +1016,7 @@ int pidfs_register_pid(struct pid *pid)
        if (attr)
                return 0;
 
-       new_attr = kmem_cache_zalloc(pidfs_attr_cachep, GFP_KERNEL);
+       new_attr = kmem_cache_zalloc(pidfs_attr_cachep, gfp);
        if (!new_attr)
                return -ENOMEM;
 

diff --git a/include/linux/pidfs.h b/include/linux/pidfs.h
index 416bdff4d6ce3cf4f2cd6c20fa01579832ed7578..0abf7da9ab236e2ecd3d8ea1fab1deef5ac21617 100644 (file)
--- a/include/linux/pidfs.h
+++ b/include/linux/pidfs.h
@@ -2,6 +2,8 @@
 #ifndef _LINUX_PID_FS_H
 #define _LINUX_PID_FS_H
 
+#include <linux/gfp_types.h>
+
 struct coredump_params;
 
 struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags);
@@ -14,7 +16,21 @@ void pidfs_exit(struct task_struct *tsk);
 void pidfs_coredump(const struct coredump_params *cprm);
 #endif
 extern const struct dentry_operations pidfs_dentry_operations;
-int pidfs_register_pid(struct pid *pid);
+int pidfs_register_pid_gfp(struct pid *pid, gfp_t gfp);
+
+/**
+ * pidfs_register_pid - register a struct pid in pidfs
+ * @pid: pid to pin
+ *
+ * Register a struct pid in pidfs.
+ *
+ * Return: On success zero, on error a negative error code is returned.
+ */
+static inline int pidfs_register_pid(struct pid *pid)
+{
+       return pidfs_register_pid_gfp(pid, GFP_KERNEL);
+}
+
 void pidfs_free_pid(struct pid *pid);
 
 #endif /* _LINUX_PID_FS_H */