[PATCH] simplify/fix first_tid()
first_tid:
/* If nr exceeds the number of threads there is nothing todo */
if (nr) {
if (nr >= get_nr_threads(leader))
goto done;
}
This is not reliable: sub-threads can exit after this check, so the
'for' loop below can overlap and proc_task_readdir() can return an
already filldir'ed dirents.
for (; pos && pid_alive(pos); pos = next_thread(pos)) {
if (--nr > 0)
continue;
Off-by-one error, will return 'leader' when nr == 1.
This patch tries to fix these problems and simplify the code.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 6092a6e..5ee46d3 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2227,38 +2227,34 @@
static struct task_struct *first_tid(struct task_struct *leader,
int tid, int nr)
{
- struct task_struct *pos = NULL;
+ struct task_struct *pos;
rcu_read_lock();
/* Attempt to start with the pid of a thread */
if (tid && (nr > 0)) {
pos = find_task_by_pid(tid);
- if (pos && (pos->group_leader != leader))
- pos = NULL;
- if (pos)
- nr = 0;
+ if (pos && (pos->group_leader == leader))
+ goto found;
}
/* If nr exceeds the number of threads there is nothing todo */
- if (nr) {
- if (nr >= get_nr_threads(leader))
- goto done;
- }
-
- /* If we haven't found our starting place yet start with the
- * leader and walk nr threads forward.
- */
- if (!pos && (nr >= 0))
- pos = leader;
-
- for (; pos && pid_alive(pos); pos = next_thread(pos)) {
- if (--nr > 0)
- continue;
- get_task_struct(pos);
- goto done;
- }
pos = NULL;
-done:
+ if (nr && nr >= get_nr_threads(leader))
+ goto out;
+
+ /* If we haven't found our starting place yet start
+ * with the leader and walk nr threads forward.
+ */
+ for (pos = leader; nr > 0; --nr) {
+ pos = next_thread(pos);
+ if (pos == leader) {
+ pos = NULL;
+ goto out;
+ }
+ }
+found:
+ get_task_struct(pos);
+out:
rcu_read_unlock();
return pos;
}