From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAB60C4332F for ; Wed, 18 May 2022 22:57:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231751AbiERW4t (ORCPT ); Wed, 18 May 2022 18:56:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231171AbiERWzx (ORCPT ); Wed, 18 May 2022 18:55:53 -0400 Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3D3822EA56; Wed, 18 May 2022 15:55:19 -0700 (PDT) Received: from in01.mta.xmission.com ([166.70.13.51]:55588) by out02.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1nrSZZ-003bgl-Vq; Wed, 18 May 2022 16:55:18 -0600 Received: from ip68-227-174-4.om.om.cox.net ([68.227.174.4]:38724 helo=localhost.localdomain) by in01.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1nrSZY-002Z0O-My; Wed, 18 May 2022 16:55:17 -0600 From: "Eric W. Biederman" To: linux-kernel@vger.kernel.org Cc: rjw@rjwysocki.net, Oleg Nesterov , mingo@kernel.org, vincent.guittot@linaro.org, dietmar.eggemann@arm.com, rostedt@goodmis.org, mgorman@suse.de, bigeasy@linutronix.de, Will Deacon , tj@kernel.org, linux-pm@vger.kernel.org, Peter Zijlstra , Richard Weinberger , Anton Ivanov , Johannes Berg , linux-um@lists.infradead.org, Chris Zankel , Max Filippov , linux-xtensa@linux-xtensa.org, Kees Cook , Jann Horn , linux-ia64@vger.kernel.org, Robert OCallahan , Kyle Huey , Richard Henderson , Ivan Kokshaysky , Matt Turner , Jason Wessel , Daniel Thompson , Douglas Anderson , Douglas Miller , Michael Ellerman , Benjamin Herrenschmidt , Paul Mackerras , "Eric W. Biederman" Date: Wed, 18 May 2022 17:53:53 -0500 Message-Id: <20220518225355.784371-14-ebiederm@xmission.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <871qwq5ucx.fsf_-_@email.froward.int.ebiederm.org> References: <871qwq5ucx.fsf_-_@email.froward.int.ebiederm.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-XM-SPF: eid=1nrSZY-002Z0O-My;;;mid=<20220518225355.784371-14-ebiederm@xmission.com>;;;hst=in01.mta.xmission.com;;;ip=68.227.174.4;;;frm=ebiederm@xmission.com;;;spf=softfail X-XM-AID: U2FsdGVkX19FLqwrnq1bvGioZrorhislxB7aEEARHFA= X-SA-Exim-Connect-IP: 68.227.174.4 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: [PATCH 14/16] signal: Protect parent child relationships by childs siglock X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The functions ptrace_stop and do_signal_stop have to drop siglock and grab tasklist_lock because the parent/child relation ship is guarded by tasklist_lock and not siglock. Simplify things by additionally guarding the parent/child relationship with siglock. This just requires a little bit of code motion. After this change tsk->parent, tsk->real_parent, tsk->ptracer_cred are all protected by tsk->siglock. The fields tsk->sibling and tsk->ptrace_entry are mostly protected by tsk->siglock. The field tsk->ptrace_entry is not protected by siglock when tsk->ptrace_entry is reused as the dead task list. The field tsk->sibling is not protected by siglock when children are reparented because their original parent dies. The field tsk->ptrace is protected by siglock except for the options which may change without siglock being held. Signed-off-by: "Eric W. Biederman" --- kernel/exit.c | 4 ++++ kernel/fork.c | 12 ++++++------ kernel/ptrace.c | 9 +++++---- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/kernel/exit.c b/kernel/exit.c index 0e26f73c49ac..bad434b23c48 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -643,11 +643,15 @@ static void forget_original_parent(struct task_struct *father, reaper = find_new_reaper(father, reaper); list_for_each_entry(p, &father->children, sibling) { + spin_lock(&p->sighand->siglock); for_each_thread(p, t) { RCU_INIT_POINTER(t->real_parent, reaper); BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father)); if (likely(!t->ptrace)) t->parent = t->real_parent; + } + spin_unlock(&p->sighand->siglock); + for_each_thread(p, t) { if (t->pdeath_signal) group_send_sig_info(t->pdeath_signal, SEND_SIG_NOINFO, t, diff --git a/kernel/fork.c b/kernel/fork.c index 9796897560ab..841021da69f3 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2367,6 +2367,12 @@ static __latent_entropy struct task_struct *copy_process( */ write_lock_irq(&tasklist_lock); + klp_copy_process(p); + + sched_core_fork(p); + + spin_lock(¤t->sighand->siglock); + /* CLONE_PARENT re-uses the old parent */ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; @@ -2381,12 +2387,6 @@ static __latent_entropy struct task_struct *copy_process( p->exit_signal = args->exit_signal; } - klp_copy_process(p); - - sched_core_fork(p); - - spin_lock(¤t->sighand->siglock); - /* * Copy seccomp details explicitly here, in case they were changed * before holding sighand lock. diff --git a/kernel/ptrace.c b/kernel/ptrace.c index fbadd2f21f09..77dfdb3d1ced 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -123,13 +123,12 @@ void __ptrace_unlink(struct task_struct *child) clear_task_syscall_work(child, SYSCALL_EMU); #endif + spin_lock(&child->sighand->siglock); child->parent = child->real_parent; list_del_init(&child->ptrace_entry); old_cred = child->ptracer_cred; child->ptracer_cred = NULL; put_cred(old_cred); - - spin_lock(&child->sighand->siglock); child->ptrace = 0; /* * Clear all pending traps and TRAPPING. TRAPPING should be @@ -441,15 +440,15 @@ static int ptrace_attach(struct task_struct *task, long request, if (task->ptrace) goto unlock_tasklist; + spin_lock(&task->sighand->siglock); task->ptrace = flags; ptrace_link(task, current); /* SEIZE doesn't trap tracee on attach */ if (!seize) - send_sig_info(SIGSTOP, SEND_SIG_PRIV, task); + send_signal_locked(SIGSTOP, SEND_SIG_PRIV, task, PIDTYPE_PID); - spin_lock(&task->sighand->siglock); /* * If the task is already STOPPED, set JOBCTL_TRAP_STOP and @@ -517,8 +516,10 @@ static int ptrace_traceme(void) * pretend ->real_parent untraces us right after return. */ if (!ret && !(current->real_parent->flags & PF_EXITING)) { + spin_lock(¤t->sighand->siglock); current->ptrace = PT_PTRACED; ptrace_link(current, current->real_parent); + spin_unlock(¤t->sighand->siglock); } } write_unlock_irq(&tasklist_lock); -- 2.35.3 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from out02.mta.xmission.com ([166.70.13.232]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nrSZa-004CFa-U6 for linux-um@lists.infradead.org; Wed, 18 May 2022 22:55:20 +0000 From: "Eric W. Biederman" Date: Wed, 18 May 2022 17:53:53 -0500 Message-Id: <20220518225355.784371-14-ebiederm@xmission.com> In-Reply-To: <871qwq5ucx.fsf_-_@email.froward.int.ebiederm.org> References: <871qwq5ucx.fsf_-_@email.froward.int.ebiederm.org> MIME-Version: 1.0 Subject: [PATCH 14/16] signal: Protect parent child relationships by childs siglock List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-um" Errors-To: linux-um-bounces+geert=linux-m68k.org@lists.infradead.org To: linux-kernel@vger.kernel.org Cc: rjw@rjwysocki.net, Oleg Nesterov , mingo@kernel.org, vincent.guittot@linaro.org, dietmar.eggemann@arm.com, rostedt@goodmis.org, mgorman@suse.de, bigeasy@linutronix.de, Will Deacon , tj@kernel.org, linux-pm@vger.kernel.org, Peter Zijlstra , Richard Weinberger , Anton Ivanov , Johannes Berg , linux-um@lists.infradead.org, Chris Zankel , Max Filippov , linux-xtensa@linux-xtensa.org, Kees Cook , Jann Horn , linux-ia64@vger.kernel.org, Robert OCallahan , Kyle Huey , Richard Henderson , Ivan Kokshaysky , Matt Turner , Jason Wessel , Daniel Thompson , Douglas Anderson , Douglas Miller , Michael Ellerman , Benjamin Herrenschmidt , Paul Mackerras , "Eric W. Biederman" The functions ptrace_stop and do_signal_stop have to drop siglock and grab tasklist_lock because the parent/child relation ship is guarded by tasklist_lock and not siglock. Simplify things by additionally guarding the parent/child relationship with siglock. This just requires a little bit of code motion. After this change tsk->parent, tsk->real_parent, tsk->ptracer_cred are all protected by tsk->siglock. The fields tsk->sibling and tsk->ptrace_entry are mostly protected by tsk->siglock. The field tsk->ptrace_entry is not protected by siglock when tsk->ptrace_entry is reused as the dead task list. The field tsk->sibling is not protected by siglock when children are reparented because their original parent dies. The field tsk->ptrace is protected by siglock except for the options which may change without siglock being held. Signed-off-by: "Eric W. Biederman" --- kernel/exit.c | 4 ++++ kernel/fork.c | 12 ++++++------ kernel/ptrace.c | 9 +++++---- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/kernel/exit.c b/kernel/exit.c index 0e26f73c49ac..bad434b23c48 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -643,11 +643,15 @@ static void forget_original_parent(struct task_struct *father, reaper = find_new_reaper(father, reaper); list_for_each_entry(p, &father->children, sibling) { + spin_lock(&p->sighand->siglock); for_each_thread(p, t) { RCU_INIT_POINTER(t->real_parent, reaper); BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father)); if (likely(!t->ptrace)) t->parent = t->real_parent; + } + spin_unlock(&p->sighand->siglock); + for_each_thread(p, t) { if (t->pdeath_signal) group_send_sig_info(t->pdeath_signal, SEND_SIG_NOINFO, t, diff --git a/kernel/fork.c b/kernel/fork.c index 9796897560ab..841021da69f3 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2367,6 +2367,12 @@ static __latent_entropy struct task_struct *copy_process( */ write_lock_irq(&tasklist_lock); + klp_copy_process(p); + + sched_core_fork(p); + + spin_lock(¤t->sighand->siglock); + /* CLONE_PARENT re-uses the old parent */ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; @@ -2381,12 +2387,6 @@ static __latent_entropy struct task_struct *copy_process( p->exit_signal = args->exit_signal; } - klp_copy_process(p); - - sched_core_fork(p); - - spin_lock(¤t->sighand->siglock); - /* * Copy seccomp details explicitly here, in case they were changed * before holding sighand lock. diff --git a/kernel/ptrace.c b/kernel/ptrace.c index fbadd2f21f09..77dfdb3d1ced 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -123,13 +123,12 @@ void __ptrace_unlink(struct task_struct *child) clear_task_syscall_work(child, SYSCALL_EMU); #endif + spin_lock(&child->sighand->siglock); child->parent = child->real_parent; list_del_init(&child->ptrace_entry); old_cred = child->ptracer_cred; child->ptracer_cred = NULL; put_cred(old_cred); - - spin_lock(&child->sighand->siglock); child->ptrace = 0; /* * Clear all pending traps and TRAPPING. TRAPPING should be @@ -441,15 +440,15 @@ static int ptrace_attach(struct task_struct *task, long request, if (task->ptrace) goto unlock_tasklist; + spin_lock(&task->sighand->siglock); task->ptrace = flags; ptrace_link(task, current); /* SEIZE doesn't trap tracee on attach */ if (!seize) - send_sig_info(SIGSTOP, SEND_SIG_PRIV, task); + send_signal_locked(SIGSTOP, SEND_SIG_PRIV, task, PIDTYPE_PID); - spin_lock(&task->sighand->siglock); /* * If the task is already STOPPED, set JOBCTL_TRAP_STOP and @@ -517,8 +516,10 @@ static int ptrace_traceme(void) * pretend ->real_parent untraces us right after return. */ if (!ret && !(current->real_parent->flags & PF_EXITING)) { + spin_lock(¤t->sighand->siglock); current->ptrace = PT_PTRACED; ptrace_link(current, current->real_parent); + spin_unlock(¤t->sighand->siglock); } } write_unlock_irq(&tasklist_lock); -- 2.35.3 _______________________________________________ linux-um mailing list linux-um@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-um From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Eric W. Biederman" Date: Wed, 18 May 2022 22:53:53 +0000 Subject: [PATCH 14/16] signal: Protect parent child relationships by childs siglock Message-Id: <20220518225355.784371-14-ebiederm@xmission.com> List-Id: References: <871qwq5ucx.fsf_-_@email.froward.int.ebiederm.org> In-Reply-To: <871qwq5ucx.fsf_-_@email.froward.int.ebiederm.org> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-kernel@vger.kernel.org Cc: rjw@rjwysocki.net, Oleg Nesterov , mingo@kernel.org, vincent.guittot@linaro.org, dietmar.eggemann@arm.com, rostedt@goodmis.org, mgorman@suse.de, bigeasy@linutronix.de, Will Deacon , tj@kernel.org, linux-pm@vger.kernel.org, Peter Zijlstra , Richard Weinberger , Anton Ivanov , Johannes Berg , linux-um@lists.infradead.org, Chris Zankel , Max Filippov , linux-xtensa@linux-xtensa.org, Kees Cook , Jann Horn , linux-ia64@vger.kernel.org, Robert OCallahan , Kyle Huey , Richard Henderson , Ivan Kokshaysky , Matt Turner , Jason Wessel , Daniel Thompson , Douglas Anderson , Douglas Miller , Michael Ellerman , Benjamin Herrenschmidt , Paul Mackerras , "Eric W. Biederman" The functions ptrace_stop and do_signal_stop have to drop siglock and grab tasklist_lock because the parent/child relation ship is guarded by tasklist_lock and not siglock. Simplify things by additionally guarding the parent/child relationship with siglock. This just requires a little bit of code motion. After this change tsk->parent, tsk->real_parent, tsk->ptracer_cred are all protected by tsk->siglock. The fields tsk->sibling and tsk->ptrace_entry are mostly protected by tsk->siglock. The field tsk->ptrace_entry is not protected by siglock when tsk->ptrace_entry is reused as the dead task list. The field tsk->sibling is not protected by siglock when children are reparented because their original parent dies. The field tsk->ptrace is protected by siglock except for the options which may change without siglock being held. Signed-off-by: "Eric W. Biederman" --- kernel/exit.c | 4 ++++ kernel/fork.c | 12 ++++++------ kernel/ptrace.c | 9 +++++---- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/kernel/exit.c b/kernel/exit.c index 0e26f73c49ac..bad434b23c48 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -643,11 +643,15 @@ static void forget_original_parent(struct task_struct *father, reaper = find_new_reaper(father, reaper); list_for_each_entry(p, &father->children, sibling) { + spin_lock(&p->sighand->siglock); for_each_thread(p, t) { RCU_INIT_POINTER(t->real_parent, reaper); BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) = father)); if (likely(!t->ptrace)) t->parent = t->real_parent; + } + spin_unlock(&p->sighand->siglock); + for_each_thread(p, t) { if (t->pdeath_signal) group_send_sig_info(t->pdeath_signal, SEND_SIG_NOINFO, t, diff --git a/kernel/fork.c b/kernel/fork.c index 9796897560ab..841021da69f3 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2367,6 +2367,12 @@ static __latent_entropy struct task_struct *copy_process( */ write_lock_irq(&tasklist_lock); + klp_copy_process(p); + + sched_core_fork(p); + + spin_lock(¤t->sighand->siglock); + /* CLONE_PARENT re-uses the old parent */ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; @@ -2381,12 +2387,6 @@ static __latent_entropy struct task_struct *copy_process( p->exit_signal = args->exit_signal; } - klp_copy_process(p); - - sched_core_fork(p); - - spin_lock(¤t->sighand->siglock); - /* * Copy seccomp details explicitly here, in case they were changed * before holding sighand lock. diff --git a/kernel/ptrace.c b/kernel/ptrace.c index fbadd2f21f09..77dfdb3d1ced 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -123,13 +123,12 @@ void __ptrace_unlink(struct task_struct *child) clear_task_syscall_work(child, SYSCALL_EMU); #endif + spin_lock(&child->sighand->siglock); child->parent = child->real_parent; list_del_init(&child->ptrace_entry); old_cred = child->ptracer_cred; child->ptracer_cred = NULL; put_cred(old_cred); - - spin_lock(&child->sighand->siglock); child->ptrace = 0; /* * Clear all pending traps and TRAPPING. TRAPPING should be @@ -441,15 +440,15 @@ static int ptrace_attach(struct task_struct *task, long request, if (task->ptrace) goto unlock_tasklist; + spin_lock(&task->sighand->siglock); task->ptrace = flags; ptrace_link(task, current); /* SEIZE doesn't trap tracee on attach */ if (!seize) - send_sig_info(SIGSTOP, SEND_SIG_PRIV, task); + send_signal_locked(SIGSTOP, SEND_SIG_PRIV, task, PIDTYPE_PID); - spin_lock(&task->sighand->siglock); /* * If the task is already STOPPED, set JOBCTL_TRAP_STOP and @@ -517,8 +516,10 @@ static int ptrace_traceme(void) * pretend ->real_parent untraces us right after return. */ if (!ret && !(current->real_parent->flags & PF_EXITING)) { + spin_lock(¤t->sighand->siglock); current->ptrace = PT_PTRACED; ptrace_link(current, current->real_parent); + spin_unlock(¤t->sighand->siglock); } } write_unlock_irq(&tasklist_lock); -- 2.35.3