From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3C0BC10F27 for ; Tue, 10 Mar 2020 20:29:29 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3DDCA222D9 for ; Tue, 10 Mar 2020 20:29:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="aVfJW5cx" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3DDCA222D9 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E2BE36B0003; Tue, 10 Mar 2020 16:29:28 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DDC9B6B0006; Tue, 10 Mar 2020 16:29:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CCB876B0007; Tue, 10 Mar 2020 16:29:28 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0215.hostedemail.com [216.40.44.215]) by kanga.kvack.org (Postfix) with ESMTP id B59F86B0003 for ; Tue, 10 Mar 2020 16:29:28 -0400 (EDT) Received: from smtpin11.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 796A145B4 for ; Tue, 10 Mar 2020 20:29:28 +0000 (UTC) X-FDA: 76580592816.11.noise17_1873d25815f39 X-HE-Tag: noise17_1873d25815f39 X-Filterd-Recvd-Size: 7956 Received: from mail-pf1-f194.google.com (mail-pf1-f194.google.com [209.85.210.194]) by imf05.hostedemail.com (Postfix) with ESMTP for ; Tue, 10 Mar 2020 20:29:27 +0000 (UTC) Received: by mail-pf1-f194.google.com with SMTP id z65so7026445pfz.8 for ; Tue, 10 Mar 2020 13:29:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=dsBrIU5gUV1pckyA8GSxROnnJLAsyLmC/ypr4CZES9w=; b=aVfJW5cxRWyiGAhHyjizHuTpIP1CVGeiD5PpVOAX8E13XOV2zio+KZuEB352+Nm2aP Llx5rft1lxfSQ6IyZMXJ54Wa89MxWC2kb8lpY1CeaItXOQO8e4J60iuFcsOvf/0Lj9YI lmf6stuUg2ygsiOeBvjwo8agJiJGT80VmqQCo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=dsBrIU5gUV1pckyA8GSxROnnJLAsyLmC/ypr4CZES9w=; b=Kg1ariy0OMHl+lbGZlWWkU3p94UvU9H0/zZ25/et13//woBnpL5IC9HTVyU7tPLsfV Tvi1OE8FFaQxYTkHYIL2KkFVrYujMcbbdRyI0+3qfTzSbUzsscOLzfA/MaGHNfCbZbvj u3vSxqdP/MiQJXI7flGR79tBGJFFbeWqp0+U95XbTVq3gP6aHu12smdyirVeYJMjwi+O zsgJEo4oZWgSoMbJPe35vGzmlSgiZ+/NhfgFz1pk64HpcB9FpF85kdK5EldIgAhcqPSw EaASJDAhhv1NDm4p4N07IEnNR9Nu+f6T8ZyN0+ne6F/9GJPDPiGHSvvTMcGgo8Azt45b emxw== X-Gm-Message-State: ANhLgQ2wfYBSHzif6Nvw2uxuzvAt2Z69R/PLaEgmKWlbsFJ/q59oFMUS LVzAxGKeTg1wwwN6hZwR3kYkRQ== X-Google-Smtp-Source: ADFU+vtvXImBX+SYYOzRy21wWe3GqfJUMiYo6Vi8Qk8uuP81efgz5a4jBX0nQr4DVT8wDqrCYZcPwg== X-Received: by 2002:a63:7f05:: with SMTP id a5mr22593983pgd.327.1583872166829; Tue, 10 Mar 2020 13:29:26 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id f4sm13279103pfn.116.2020.03.10.13.29.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Mar 2020 13:29:25 -0700 (PDT) Date: Tue, 10 Mar 2020 13:29:25 -0700 From: Kees Cook To: "Eric W. Biederman" Cc: Bernd Edlinger , Christian Brauner , Jann Horn , Jonathan Corbet , Alexander Viro , Andrew Morton , Alexey Dobriyan , Thomas Gleixner , Oleg Nesterov , Frederic Weisbecker , Andrei Vagin , Ingo Molnar , "Peter Zijlstra (Intel)" , Yuyang Du , David Hildenbrand , Sebastian Andrzej Siewior , Anshuman Khandual , David Howells , James Morris , Greg Kroah-Hartman , Shakeel Butt , Jason Gunthorpe , Christian Kellner , Andrea Arcangeli , Aleksa Sarai , "Dmitry V. Levin" , "linux-doc@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "linux-mm@kvack.org" , "stable@vger.kernel.org" , "linux-api@vger.kernel.org" Subject: Re: [PATCH v2 2/5] exec: Factor unshare_sighand out of de_thread and call it separately Message-ID: <202003101319.BAE7B535A@keescook> References: <87v9nlii0b.fsf@x220.int.ebiederm.org> <87a74xi4kz.fsf@x220.int.ebiederm.org> <87r1y8dqqz.fsf@x220.int.ebiederm.org> <87tv32cxmf.fsf_-_@x220.int.ebiederm.org> <87v9ne5y4y.fsf_-_@x220.int.ebiederm.org> <87k13u5y26.fsf_-_@x220.int.ebiederm.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87k13u5y26.fsf_-_@x220.int.ebiederm.org> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, Mar 08, 2020 at 04:36:17PM -0500, Eric W. Biederman wrote: > > This makes the code clearer and makes it easier to implement a mutex > that is not taken over any locations that may block indefinitely waiting > for userspace. > > Signed-off-by: "Eric W. Biederman" > --- > fs/exec.c | 39 ++++++++++++++++++++++++++------------- > 1 file changed, 26 insertions(+), 13 deletions(-) > > diff --git a/fs/exec.c b/fs/exec.c > index c3f34791f2f0..ff74b9a74d34 100644 > --- a/fs/exec.c > +++ b/fs/exec.c > @@ -1194,6 +1194,23 @@ static int de_thread(struct task_struct *tsk) > flush_itimer_signals(); > #endif Semi-related (existing behavior): in de_thread(), what keeps the thread group from changing? i.e.: if (thread_group_empty(tsk)) goto no_thread_group; /* * Kill all other threads in the thread group. */ spin_lock_irq(lock); ... kill other threads under lock ... Why is the thread_group_emtpy() test not under lock? > > + BUG_ON(!thread_group_leader(tsk)); > + return 0; > + > +killed: > + /* protects against exit_notify() and __exit_signal() */ I wonder if include/linux/sched/task.h's definition of tasklist_lock should explicitly gain note about group_exit_task and notify_count, or, alternatively, signal.h's section on these fields should gain a comment? tasklist_lock is unmentioned in signal.h... :( > + read_lock(&tasklist_lock); > + sig->group_exit_task = NULL; > + sig->notify_count = 0; > + read_unlock(&tasklist_lock); > + return -EAGAIN; > +} > + > + > +static int unshare_sighand(struct task_struct *me) > +{ > + struct sighand_struct *oldsighand = me->sighand; > + > if (refcount_read(&oldsighand->count) != 1) { > struct sighand_struct *newsighand; > /* > @@ -1210,23 +1227,13 @@ static int de_thread(struct task_struct *tsk) > > write_lock_irq(&tasklist_lock); > spin_lock(&oldsighand->siglock); > - rcu_assign_pointer(tsk->sighand, newsighand); > + rcu_assign_pointer(me->sighand, newsighand); > spin_unlock(&oldsighand->siglock); > write_unlock_irq(&tasklist_lock); > > __cleanup_sighand(oldsighand); > } > - > - BUG_ON(!thread_group_leader(tsk)); > return 0; > - > -killed: > - /* protects against exit_notify() and __exit_signal() */ > - read_lock(&tasklist_lock); > - sig->group_exit_task = NULL; > - sig->notify_count = 0; > - read_unlock(&tasklist_lock); > - return -EAGAIN; > } > > char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk) > @@ -1264,13 +1271,19 @@ int flush_old_exec(struct linux_binprm * bprm) > int retval; > > /* > - * Make sure we have a private signal table and that > - * we are unassociated from the previous thread group. > + * Make this the only thread in the thread group. > */ > retval = de_thread(me); > if (retval) > goto out; > > + /* > + * Make the signal table private. > + */ > + retval = unshare_sighand(me); > + if (retval) > + goto out; > + > /* > * Must be called _before_ exec_mmap() as bprm->mm is > * not visibile until then. This also enables the update > -- > 2.25.0 Otherwise, yes, sensible separation. Reviewed-by: Kees Cook -- Kees Cook