fs: stop rewriting paths for PF_EXITING | PF_DUMPCORE

Skip exiting and core-dumping tasks when rewriting fs_struct paths in
chroot_fs_refs(). Such a task is about to release its fs_struct via
exit_fs() anyway, so the worst case is that it lingers on a stale
root/pwd until it does.

This isn't entirely free: a skipped task keeps its reference on the old
root, so after a pivot_root() the old root can't be torn down until the
task is gone. With umount2(MNT_DETACH) that only defers destruction of
the old rootfs; a plain umount() could in principle fail with -EBUSY.
In practice this doesn't matter -- pivot_root(2) is meant to be paired
with MNT_DETACH and isn't issued while other tasks are actively using
the mount namespace -- so the transient pin is harmless.

Link: https://patch.msgid.link/20260601-work-kthread-nullfs-v4-25-77ee053060e0@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/fs_struct.c b/fs/fs_struct.c
index 2a98cfbedd32c7acd3c1ba3e38deae3e5b14448d..34699f3b6f8819e5a11d1efbbb0a85e38101fc43 100644 (file)
--- a/fs/fs_struct.c
+++ b/fs/fs_struct.c
@@ -61,8 +61,7 @@ void chroot_fs_refs(const struct path *old_root, const struct path *new_root)
 
        read_lock(&tasklist_lock);
        for_each_process_thread(g, p) {
-               /* leave kthreads alone */
-               if (p->flags & PF_KTHREAD)
+               if (p->flags & (PF_KTHREAD | PF_EXITING | PF_DUMPCORE))
                        continue;
 
                task_lock(p);