I am writing an LKM that provides an alternative interface for one userspace process to read the memory of another userspace process.

One ioctl call to my LKM allows the user to set a target process. As part of this process, my LKM needs to acquire a pointer to the task_struct and mm_struct of the target process.

I iterate over all tasks with the for_each_process macro. I understand that the pointer I acquire with this macro can become invalid at any point because the task may exit and in turn have its task_struct be deallocated.

If I increment the usage member of my target’s task_struct with get_task_struct(), what effect does this have on the process represented by this task_struct?

• Will it still be able to exit?

• Even if it exits, will its PID be listed in procfs and by extension in ps and top output?

Finally, I would like to know if there is some overarching principle behind refcounts and functions like get_task_struct(). What similarities are there between the effects of get_task_struct() and mmgrab() and other refcount incrementing functions for key data structures in the kernel? (Besides the fact that they all use RCU?