pid_ns: (BUG 11391) change ->child_reaper when init->group_leader exits

We don't change pid_ns->child_reaper when the main thread of the
subnamespace init exits.  As Robert Rex <robert.rex@exasol.com> pointed
out this is wrong.

Yes, the re-parenting itself works correctly, but if the reparented task
exits it needs ->parent->nsproxy->pid_ns in do_notify_parent(), and if the
main thread is zombie its ->nsproxy was already cleared by
exit_task_namespaces().

Introduce the new function, find_new_reaper(), which finds the new
->parent for the re-parenting and changes ->child_reaper if needed.  Kill
the now unneeded exit_child_reaper().

Also move the changing of ->child_reaper from zap_pid_ns_processes() to
find_new_reaper(), this consolidates the games with ->child_reaper and
makes it stable under tasklist_lock.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11391

Reported-by: Robert Rex <robert.rex@exasol.com>
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/kernel/exit.c b/kernel/exit.c
index 75c6473..25ed2ad 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -831,26 +831,50 @@ static void reparent_thread(struct task_struct *p, struct task_struct *father)
  * the child reaper process (ie "init") in our pid
  * space.
  */
+static struct task_struct *find_new_reaper(struct task_struct *father)
+{
+       struct pid_namespace *pid_ns = task_active_pid_ns(father);
+       struct task_struct *thread;
+
+       thread = father;
+       while_each_thread(father, thread) {
+               if (thread->flags & PF_EXITING)
+                       continue;
+               if (unlikely(pid_ns->child_reaper == father))
+                       pid_ns->child_reaper = thread;
+               return thread;
+       }
+
+       if (unlikely(pid_ns->child_reaper == father)) {
+               write_unlock_irq(&tasklist_lock);
+               if (unlikely(pid_ns == &init_pid_ns))
+                       panic("Attempted to kill init!");
+
+               zap_pid_ns_processes(pid_ns);
+               write_lock_irq(&tasklist_lock);
+               /*
+                * We can not clear ->child_reaper or leave it alone.
+                * There may by stealth EXIT_DEAD tasks on ->children,
+                * forget_original_parent() must move them somewhere.
+                */
+               pid_ns->child_reaper = init_pid_ns.child_reaper;
+       }
+
+       return pid_ns->child_reaper;
+}
+
 static void forget_original_parent(struct task_struct *father)
 {
-       struct task_struct *p, *n, *reaper = father;
+       struct task_struct *p, *n, *reaper;
        LIST_HEAD(ptrace_dead);
 
        write_lock_irq(&tasklist_lock);
-
+       reaper = find_new_reaper(father);
        /*
         * First clean up ptrace if we were using it.
         */
        ptrace_exit(father, &ptrace_dead);
 
-       do {
-               reaper = next_thread(reaper);
-               if (reaper == father) {
-                       reaper = task_child_reaper(father);
-                       break;
-               }
-       } while (reaper->flags & PF_EXITING);
-
        list_for_each_entry_safe(p, n, &father->children, sibling) {
                p->real_parent = reaper;
                if (p->parent == father) {
@@ -959,39 +983,6 @@ static void check_stack_usage(void)
 static inline void check_stack_usage(void) {}
 #endif
 
-static inline void exit_child_reaper(struct task_struct *tsk)
-{
-       if (likely(tsk->group_leader != task_child_reaper(tsk)))
-               return;
-
-       if (tsk->nsproxy->pid_ns == &init_pid_ns)
-               panic("Attempted to kill init!");
-
-       /*
-        * @tsk is the last thread in the 'cgroup-init' and is exiting.
-        * Terminate all remaining processes in the namespace and reap them
-        * before exiting @tsk.
-        *
-        * Note that @tsk (last thread of cgroup-init) may not necessarily
-        * be the child-reaper (i.e main thread of cgroup-init) of the
-        * namespace i.e the child_reaper may have already exited.
-        *
-        * Even after a child_reaper exits, we let it inherit orphaned children,
-        * because, pid_ns->child_reaper remains valid as long as there is
-        * at least one living sub-thread in the cgroup init.
-
-        * This living sub-thread of the cgroup-init will be notified when
-        * a child inherited by the 'child-reaper' exits (do_notify_parent()
-        * uses __group_send_sig_info()). Further, when reaping child processes,
-        * do_wait() iterates over children of all living sub threads.
-
-        * i.e even though 'child_reaper' thread is listed as the parent of the
-        * orphaned children, any living sub-thread in the cgroup-init can
-        * perform the role of the child_reaper.
-        */
-       zap_pid_ns_processes(tsk->nsproxy->pid_ns);
-}
-
 NORET_TYPE void do_exit(long code)
 {
        struct task_struct *tsk = current;
@@ -1051,7 +1042,6 @@ NORET_TYPE void do_exit(long code)
        }
        group_dead = atomic_dec_and_test(&tsk->signal->live);
        if (group_dead) {
-               exit_child_reaper(tsk);
                hrtimer_cancel(&tsk->signal->real_timer);
                exit_itimers(tsk->signal);
        }

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 598f1ee..fab8ea8 100644 (file)
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -179,12 +179,6 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
                rc = sys_wait4(-1, NULL, __WALL, NULL);
        } while (rc != -ECHILD);
 
-       /*
-        * We can not clear ->child_reaper or leave it alone.
-        * There may by stealth EXIT_DEAD tasks on ->children,
-        * forget_original_parent() must move them somewhere.
-        */
-       pid_ns->child_reaper = init_pid_ns.child_reaper;
        acct_exit_ns(pid_ns);
        return;
 }