From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F271C3F2CD for ; Fri, 6 Mar 2020 05:11:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5944720728 for ; Fri, 6 Mar 2020 05:11:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726034AbgCFFLW (ORCPT ); Fri, 6 Mar 2020 00:11:22 -0500 Received: from out01.mta.xmission.com ([166.70.13.231]:54456 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725799AbgCFFLV (ORCPT ); Fri, 6 Mar 2020 00:11:21 -0500 Received: from in02.mta.xmission.com ([166.70.13.52]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jA5GZ-0005o8-Nj; Thu, 05 Mar 2020 22:11:19 -0700 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jA5GY-0003qV-TP; Thu, 05 Mar 2020 22:11:19 -0700 From: ebiederm@xmission.com (Eric W. Biederman) To: Bernd Edlinger Cc: Christian Brauner , Kees Cook , Jann Horn , Jonathan Corbet , Alexander Viro , Andrew Morton , Alexey Dobriyan , Thomas Gleixner , Oleg Nesterov , Frederic Weisbecker , Andrei Vagin , Ingo Molnar , "Peter Zijlstra \(Intel\)" , Yuyang Du , David Hildenbrand , Sebastian Andrzej Siewior , Anshuman Khandual , David Howells , James Morris , Greg Kroah-Hartman , Shakeel Butt , Jason Gunthorpe , Christian Kellner , Andrea Arcangeli , Aleksa Sarai , "Dmitry V. Levin" , "linux-doc\@vger.kernel.org" , "linux-kernel\@vger.kernel.org" , "linux-fsdevel\@vger.kernel.org" , "linux-mm\@kvack.org" , "stable\@vger.kernel.org" , "linux-api\@vger.kernel.org" References: <87v9nmjulm.fsf@x220.int.ebiederm.org> <202003021531.C77EF10@keescook> <20200303085802.eqn6jbhwxtmz4j2x@wittgenstein> <87v9nlii0b.fsf@x220.int.ebiederm.org> <87a74xi4kz.fsf@x220.int.ebiederm.org> <87r1y8dqqz.fsf@x220.int.ebiederm.org> <87tv32cxmf.fsf_-_@x220.int.ebiederm.org> <87o8tacxl3.fsf_-_@x220.int.ebiederm.org> Date: Thu, 05 Mar 2020 23:09:04 -0600 In-Reply-To: (Bernd Edlinger's message of "Thu, 5 Mar 2020 22:56:01 +0000") Message-ID: <87pndqax3j.fsf@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1jA5GY-0003qV-TP;;;mid=<87pndqax3j.fsf@x220.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/OxSTSv2CXmzMmUtD1Q1oXz5BqRMOOkKE= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH 1/2] exec: Properly mark the point of no return X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Bernd Edlinger writes: > On 3/5/20 10:15 PM, Eric W. Biederman wrote: >> >> Add a flag binfmt->unrecoverable to mark when execution has gotten to >> the point where it is impossible to return to userspace with the >> calling process unchanged. >> >> While techinically this state starts as soon as de_thread starts >> killing threads, the only return path at that point is if there is a >> fatal signal pending. I have choosen instead to set unrecoverable >> when the killing stops, and there are possibilities of failures other >> than fatal signals. In particular it is possible for the allocation >> of a new sighand structure to fail. >> >> Setting unrecoverable at this point has the benefit that other actions >> can be taken after the other threads are all dead, and the >> unrecoverable flag can double as a flag that those actions have been >> taken. >> >> Signed-off-by: "Eric W. Biederman" >> --- >> fs/exec.c | 7 ++++--- >> include/linux/binfmts.h | 7 ++++++- >> 2 files changed, 10 insertions(+), 4 deletions(-) >> >> diff --git a/fs/exec.c b/fs/exec.c >> index db17be51b112..c243f9660d46 100644 >> --- a/fs/exec.c >> +++ b/fs/exec.c >> @@ -1061,7 +1061,7 @@ static int exec_mmap(struct mm_struct *mm) >> * disturbing other processes. (Other processes might share the signal >> * table via the CLONE_SIGHAND option to clone().) >> */ >> -static int de_thread(struct task_struct *tsk) >> +static int de_thread(struct linux_binprm *bprm, struct task_struct *tsk) >> { >> struct signal_struct *sig = tsk->signal; >> struct sighand_struct *oldsighand = tsk->sighand; >> @@ -1182,6 +1182,7 @@ static int de_thread(struct task_struct *tsk) >> release_task(leader); >> } >> >> + bprm->unrecoverable = true; >> sig->group_exit_task = NULL; >> sig->notify_count = 0; >> > > ah, sorry, > if (thread_group_empty(tsk)) > goto no_thread_group; > will skip this: > > sig->group_exit_task = NULL; > sig->notify_count = 0; > > no_thread_group: > /* we have changed execution domain */ > tsk->exit_signal = SIGCHLD; > > so I think the bprm->unrecoverable = true; should be here? Absolutely. Thank you very much. This is why I try and keep things to one clear simple thing per patch so silly thinkos like that can be caught. Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40A25C3F2D8 for ; Fri, 6 Mar 2020 05:11:24 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0ED5020728 for ; Fri, 6 Mar 2020 05:11:23 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0ED5020728 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=xmission.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id B77F36B0005; Fri, 6 Mar 2020 00:11:22 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B291E6B0006; Fri, 6 Mar 2020 00:11:22 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A1BA56B0007; Fri, 6 Mar 2020 00:11:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0229.hostedemail.com [216.40.44.229]) by kanga.kvack.org (Postfix) with ESMTP id 864AF6B0005 for ; Fri, 6 Mar 2020 00:11:22 -0500 (EST) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 5640F3D01 for ; Fri, 6 Mar 2020 05:11:22 +0000 (UTC) X-FDA: 76563764004.07.slip96_4625dcddec129 X-HE-Tag: slip96_4625dcddec129 X-Filterd-Recvd-Size: 8131 Received: from out01.mta.xmission.com (out01.mta.xmission.com [166.70.13.231]) by imf40.hostedemail.com (Postfix) with ESMTP for ; Fri, 6 Mar 2020 05:11:21 +0000 (UTC) Received: from in02.mta.xmission.com ([166.70.13.52]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jA5GZ-0005o8-Nj; Thu, 05 Mar 2020 22:11:19 -0700 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jA5GY-0003qV-TP; Thu, 05 Mar 2020 22:11:19 -0700 From: ebiederm@xmission.com (Eric W. Biederman) To: Bernd Edlinger Cc: Christian Brauner , Kees Cook , Jann Horn , Jonathan Corbet , Alexander Viro , Andrew Morton , Alexey Dobriyan , Thomas Gleixner , Oleg Nesterov , Frederic Weisbecker , Andrei Vagin , Ingo Molnar , "Peter Zijlstra \(Intel\)" , Yuyang Du , David Hildenbrand , Sebastian Andrzej Siewior , Anshuman Khandual , David Howells , James Morris , Greg Kroah-Hartman , Shakeel Butt , Jason Gunthorpe , Christian Kellner , Andrea Arcangeli , Aleksa Sarai , "Dmitry V. Levin" , "linux-doc\@vger.kernel.org" , "linux-kernel\@vger.kernel.org" , "linux-fsdevel\@vger.kernel.org" , "linux-mm\@kvack.org" , "stable\@vger.kernel.org" , "linux-api\@vger.kernel.org" References: <87v9nmjulm.fsf@x220.int.ebiederm.org> <202003021531.C77EF10@keescook> <20200303085802.eqn6jbhwxtmz4j2x@wittgenstein> <87v9nlii0b.fsf@x220.int.ebiederm.org> <87a74xi4kz.fsf@x220.int.ebiederm.org> <87r1y8dqqz.fsf@x220.int.ebiederm.org> <87tv32cxmf.fsf_-_@x220.int.ebiederm.org> <87o8tacxl3.fsf_-_@x220.int.ebiederm.org> Date: Thu, 05 Mar 2020 23:09:04 -0600 In-Reply-To: (Bernd Edlinger's message of "Thu, 5 Mar 2020 22:56:01 +0000") Message-ID: <87pndqax3j.fsf@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1jA5GY-0003qV-TP;;;mid=<87pndqax3j.fsf@x220.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/OxSTSv2CXmzMmUtD1Q1oXz5BqRMOOkKE= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH 1/2] exec: Properly mark the point of no return X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Bernd Edlinger writes: > On 3/5/20 10:15 PM, Eric W. Biederman wrote: >> >> Add a flag binfmt->unrecoverable to mark when execution has gotten to >> the point where it is impossible to return to userspace with the >> calling process unchanged. >> >> While techinically this state starts as soon as de_thread starts >> killing threads, the only return path at that point is if there is a >> fatal signal pending. I have choosen instead to set unrecoverable >> when the killing stops, and there are possibilities of failures other >> than fatal signals. In particular it is possible for the allocation >> of a new sighand structure to fail. >> >> Setting unrecoverable at this point has the benefit that other actions >> can be taken after the other threads are all dead, and the >> unrecoverable flag can double as a flag that those actions have been >> taken. >> >> Signed-off-by: "Eric W. Biederman" >> --- >> fs/exec.c | 7 ++++--- >> include/linux/binfmts.h | 7 ++++++- >> 2 files changed, 10 insertions(+), 4 deletions(-) >> >> diff --git a/fs/exec.c b/fs/exec.c >> index db17be51b112..c243f9660d46 100644 >> --- a/fs/exec.c >> +++ b/fs/exec.c >> @@ -1061,7 +1061,7 @@ static int exec_mmap(struct mm_struct *mm) >> * disturbing other processes. (Other processes might share the signal >> * table via the CLONE_SIGHAND option to clone().) >> */ >> -static int de_thread(struct task_struct *tsk) >> +static int de_thread(struct linux_binprm *bprm, struct task_struct *tsk) >> { >> struct signal_struct *sig = tsk->signal; >> struct sighand_struct *oldsighand = tsk->sighand; >> @@ -1182,6 +1182,7 @@ static int de_thread(struct task_struct *tsk) >> release_task(leader); >> } >> >> + bprm->unrecoverable = true; >> sig->group_exit_task = NULL; >> sig->notify_count = 0; >> > > ah, sorry, > if (thread_group_empty(tsk)) > goto no_thread_group; > will skip this: > > sig->group_exit_task = NULL; > sig->notify_count = 0; > > no_thread_group: > /* we have changed execution domain */ > tsk->exit_signal = SIGCHLD; > > so I think the bprm->unrecoverable = true; should be here? Absolutely. Thank you very much. This is why I try and keep things to one clear simple thing per patch so silly thinkos like that can be caught. Eric