block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
authorDavidlohr Bueso <dave@stgolabs.net>
Fri, 10 Dec 2021 18:20:58 +0000 (10:20 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 14 Dec 2021 09:16:55 +0000 (10:16 +0100)
commit00be34f856c3d7f19cd7a5cd0e84aa4939677186
treeac3f834bb146fbe4f249fc5acc67b32e9a1d51db
parentbc6d64c4307a5e7aaa06beea76c81199ba69dbfe
block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)

commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream.

do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent
change_pid(PIDTYPE_PGID) that can move the task from one hlist
to another while iterating. Serialize ioprio_get to take
the tasklist_lock in this case, just like it's set counterpart.

Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}())
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
block/ioprio.c