Kernel: Make ProcessGroup a ListedRefCounted and fix two races

This closes two race windows:

- ProcessGroup removed itself from the "all process groups" list in its
  destructor. It was possible to walk the list between the last unref()
  and the destructor invocation, and grab a pointer to a ProcessGroup
  that was about to get deleted.

- sys$setsid() could end up creating a process group that already
  existed, as there was a race window between checking if the PGID
  is used, and actually creating a ProcessGroup with that PGID.

1 files changed, 8 insertions, 8 deletions

diff --git a/Kernel/ProcessGroup.h b/Kernel/ProcessGroup.h
index 217316347c..2f74ff8d79 100644
--- a/Kernel/ProcessGroup.h
+++ b/Kernel/ProcessGroup.h
@@ -1,15 +1,15 @@
 /*
- * Copyright (c) 2020, the SerenityOS developers.
+ * Copyright (c) 2020-2023, the SerenityOS developers.
  *
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
 #pragma once
 
-#include <AK/AtomicRefCounted.h>
 #include <AK/IntrusiveList.h>
 #include <AK/RefPtr.h>
 #include <Kernel/Forward.h>
+#include <Kernel/Library/ListedRefCounted.h>
 #include <Kernel/Library/LockWeakable.h>
 #include <Kernel/Locking/SpinlockProtected.h>
 #include <Kernel/UnixTypes.h>
@@ -17,7 +17,7 @@
 namespace Kernel {
 
 class ProcessGroup
-    : public AtomicRefCounted<ProcessGroup>
+    : public ListedRefCounted<ProcessGroup, LockType::Spinlock>
     , public LockWeakable<ProcessGroup> {
 
     AK_MAKE_NONMOVABLE(ProcessGroup);
@@ -26,7 +26,7 @@ class ProcessGroup
 public:
     ~ProcessGroup();
 
-    static ErrorOr<NonnullRefPtr<ProcessGroup>> create(ProcessGroupID);
+    static ErrorOr<NonnullRefPtr<ProcessGroup>> create_if_unused_pgid(ProcessGroupID);
     static ErrorOr<NonnullRefPtr<ProcessGroup>> find_or_create(ProcessGroupID);
     static RefPtr<ProcessGroup> from_pgid(ProcessGroupID);
 
@@ -38,13 +38,13 @@ private:
     {
     }
 
-    IntrusiveListNode<ProcessGroup> m_list_node;
     ProcessGroupID m_pgid;
 
+    mutable IntrusiveListNode<ProcessGroup> m_list_node;
+
 public:
-    using List = IntrusiveList<&ProcessGroup::m_list_node>;
+    using AllInstancesList = IntrusiveList<&ProcessGroup::m_list_node>;
+    static SpinlockProtected<AllInstancesList, LockRank::None>& all_instances();
 };
 
-SpinlockProtected<ProcessGroup::List, LockRank::None>& process_groups();
-
 }