From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.5 required=3.0 tests=DKIM_ADSP_CUSTOM_MED, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D5B6C352A3 for ; Mon, 10 Feb 2020 15:07:31 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id 8F72C20661 for ; Mon, 10 Feb 2020 15:07:30 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8F72C20661 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-17741-kernel-hardening=archiver.kernel.org@lists.openwall.com Received: (qmail 1743 invoked by uid 550); 10 Feb 2020 15:06:26 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Received: (qmail 1679 invoked from network); 10 Feb 2020 15:06:26 -0000 From: Alexey Gladkov To: LKML , Kernel Hardening , Linux API , Linux FS Devel , Linux Security Module Cc: Akinobu Mita , Alexander Viro , Alexey Dobriyan , Alexey Gladkov , Andrew Morton , Andy Lutomirski , Daniel Micay , Djalal Harouni , "Dmitry V . Levin" , "Eric W . Biederman" , Greg Kroah-Hartman , Ingo Molnar , "J . Bruce Fields" , Jeff Layton , Jonathan Corbet , Kees Cook , Linus Torvalds , Oleg Nesterov , Solar Designer Subject: [PATCH v8 07/11] proc: flush task dcache entries from all procfs instances Date: Mon, 10 Feb 2020 16:05:15 +0100 Message-Id: <20200210150519.538333-8-gladkov.alexey@gmail.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200210150519.538333-1-gladkov.alexey@gmail.com> References: <20200210150519.538333-1-gladkov.alexey@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This allows to flush dcache entries of a task on multiple procfs mounts per pid namespace. The RCU lock is used because the number of reads at the task exit time is much larger than the number of procfs mounts. Cc: Kees Cook Cc: Andy Lutomirski Signed-off-by: Djalal Harouni Suggested-by: Linus Torvalds Signed-off-by: Alexey Gladkov --- fs/proc/base.c | 20 +++++++++++++++----- fs/proc/root.c | 27 ++++++++++++++++++++++++++- include/linux/pid_namespace.h | 2 ++ include/linux/proc_fs.h | 2 ++ 4 files changed, 45 insertions(+), 6 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 4ccb280a3e79..24b7c620ded3 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3133,7 +3133,7 @@ static const struct inode_operations proc_tgid_base_inode_operations = { .permission = proc_pid_permission, }; -static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid) +static void proc_flush_task_mnt_root(struct dentry *mnt_root, pid_t pid, pid_t tgid) { struct dentry *dentry, *leader, *dir; char buf[10 + 1]; @@ -3142,7 +3142,7 @@ static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid) name.name = buf; name.len = snprintf(buf, sizeof(buf), "%u", pid); /* no ->d_hash() rejects on procfs */ - dentry = d_hash_and_lookup(mnt->mnt_root, &name); + dentry = d_hash_and_lookup(mnt_root, &name); if (dentry) { d_invalidate(dentry); dput(dentry); @@ -3153,7 +3153,7 @@ static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid) name.name = buf; name.len = snprintf(buf, sizeof(buf), "%u", tgid); - leader = d_hash_and_lookup(mnt->mnt_root, &name); + leader = d_hash_and_lookup(mnt_root, &name); if (!leader) goto out; @@ -3208,14 +3208,24 @@ void proc_flush_task(struct task_struct *task) int i; struct pid *pid, *tgid; struct upid *upid; + struct dentry *mnt_root; + struct proc_fs_info *fs_info; pid = task_pid(task); tgid = task_tgid(task); for (i = 0; i <= pid->level; i++) { upid = &pid->numbers[i]; - proc_flush_task_mnt(upid->ns->proc_mnt, upid->nr, - tgid->numbers[i].nr); + + rcu_read_lock(); + list_for_each_entry_rcu(fs_info, &upid->ns->proc_mounts, pidns_entry) { + mnt_root = fs_info->m_super->s_root; + proc_flush_task_mnt_root(mnt_root, upid->nr, tgid->numbers[i].nr); + } + rcu_read_unlock(); + + mnt_root = upid->ns->proc_mnt->mnt_root; + proc_flush_task_mnt_root(mnt_root, upid->nr, tgid->numbers[i].nr); } } diff --git a/fs/proc/root.c b/fs/proc/root.c index 5d5cba4c899b..e2bb015da1a8 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -149,7 +149,22 @@ static int proc_fill_super(struct super_block *s, struct fs_context *fc) if (ret) { return ret; } - return proc_setup_thread_self(s); + + ret = proc_setup_thread_self(s); + if (ret) { + return ret; + } + + /* + * back reference to flush dcache entries at process exit time. + */ + ctx->fs_info->m_super = s; + + spin_lock(&pid_ns->proc_mounts_lock); + list_add_tail_rcu(&ctx->fs_info->pidns_entry, &pid_ns->proc_mounts); + spin_unlock(&pid_ns->proc_mounts_lock); + + return 0; } static int proc_reconfigure(struct fs_context *fc) @@ -211,10 +226,17 @@ static void proc_kill_sb(struct super_block *sb) { struct proc_fs_info *fs_info = proc_sb_info(sb); + spin_lock(&fs_info->pid_ns->proc_mounts_lock); + list_del_rcu(&fs_info->pidns_entry); + spin_unlock(&fs_info->pid_ns->proc_mounts_lock); + + synchronize_rcu(); + if (fs_info->proc_self) dput(fs_info->proc_self); if (fs_info->proc_thread_self) dput(fs_info->proc_thread_self); + kill_anon_super(sb); put_pid_ns(fs_info->pid_ns); kfree(fs_info); @@ -336,6 +358,9 @@ int pid_ns_prepare_proc(struct pid_namespace *ns) ctx->fs_info->pid_ns = ns; } + spin_lock_init(&ns->proc_mounts_lock); + INIT_LIST_HEAD_RCU(&ns->proc_mounts); + mnt = fc_mount(fc); put_fs_context(fc); if (IS_ERR(mnt)) diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h index 66f47f1afe0d..c36af1dfd862 100644 --- a/include/linux/pid_namespace.h +++ b/include/linux/pid_namespace.h @@ -26,6 +26,8 @@ struct pid_namespace { struct pid_namespace *parent; #ifdef CONFIG_PROC_FS struct vfsmount *proc_mnt; /* Internal proc mounted during each new pidns */ + spinlock_t proc_mounts_lock; + struct list_head proc_mounts; /* list of separated procfs mounts */ #endif #ifdef CONFIG_BSD_PROCESS_ACCT struct fs_pin *bacct; diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 5f0b1b7e4271..f307940f8311 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -20,6 +20,8 @@ enum { }; struct proc_fs_info { + struct list_head pidns_entry; /* Node in procfs_mounts of a pidns */ + struct super_block *m_super; struct pid_namespace *pid_ns; struct dentry *proc_self; /* For /proc/self */ struct dentry *proc_thread_self; /* For /proc/thread-self */ -- 2.24.1