On 04/30, Joel Fernandes (Google) wrote:
>
> +static unsigned int pidfd_poll(struct file *file, struct poll_table_struct
> *pts)
> +{
> + struct task_struct *task;
> + struct pid *pid = file->private_data;
> + int poll_flags = 0;
> +
> + poll_wait(file, &pid->wait_pidfd, pts);
> +
> + rcu_read_lock();
> + task = pid_task(pid, PIDTYPE_PID);
> + WARN_ON_ONCE(task && !thread_group_leader(task));
^^^^^^^^^^^^^^^^^^^^^^^^^^
Ah, this is not right, we can race with de_thread() which changes the leader,
in particular it does leader->exit_signal = -1 to indicate that this thread is
no longer a group leader, but pid_task() can return the old leader.
We are going to check thread_group_empty() below, it won't be true in this case,
so this race should not make any harm.
Just remove this WARN_ON(). We can't use has_group_leader_pid(), it can return
false if pid_task() returns the new leader.
Otherwise I see no problems.
Oleg.
