random PIDs
Quoted 5 lines
M> IIRC
get_pidwill loop forever if it doesn't find a free pid, and in the M> worst case you can trigger that with ~11000 running threads.Ah, ok. But why would you have 11.000 running threads?
Denial of Service attack. 11000 processes and the kernel locks up hard, regardless of the amount of memory.(sane ulimits prevent that)
Quoted 8 lines
M> And the current code can create multiple threads with the same pid (I M> never tried to trigger that bug, but it seems to be possible)
mine will do that too:
if (flags &
CLONE_PID)
returncurrent->pid;
CLONE_PID is a special flag for the boot process, normal processes can't set that flag. (first line of do_fork() returns -EPERM)
Even without CLONE_PID two threads can get the same pid:get_pid searches for a new pid by scanning though the task list. But the caller of get_pid doesn't atomically add the new value to the task list.
If copy_fs, copy_files, copy_mm sleep, then a second thread could get the same pid.
It's only possible if nearly all pid values are used up, so it's not a problem that must be fixed immediately.
--
Manfred