* [PATCH 0/1] cred: copy_process() should clear child->replacement_session_keyring
@ 2012-04-09 19:03 Oleg Nesterov
2012-04-09 19:03 ` [PATCH 1/1] " Oleg Nesterov
2012-04-11 10:47 ` [PATCH 1/1] cred: copy_process() should clear child->replacement_session_keyring David Howells
0 siblings, 2 replies; 5+ messages in thread
From: Oleg Nesterov @ 2012-04-09 19:03 UTC (permalink / raw)
To: David Howells, Linus Torvalds; +Cc: Andrew Morton, linux-kernel, stable
Hello.
Looks trivial, but I do not know how to test and I don't understand
this code. David, please review ;)
Note: initially this was 1/2. The usage of >replacement_session_keyring
is racy, although the problem is minor. I think that instead of fixing
a lot of key_replace_session_keyring's callers in arch/ we can add the
simple abstraction layer and kill ->replacement_session_keyring. I'll
try to send the patches tomorrow.
Btw. exit_creds() does validate_creds(cred) right before put_cred(cred),
without alter_cred_subscribers() in between this looks unneeded?
Oleg.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 1/1] cred: copy_process() should clear child->replacement_session_keyring
2012-04-09 19:03 [PATCH 0/1] cred: copy_process() should clear child->replacement_session_keyring Oleg Nesterov
@ 2012-04-09 19:03 ` Oleg Nesterov
2012-04-10 1:05 ` [RFC PATCH 0/1] task_work_queue: add generic process-context callbacks Oleg Nesterov
2012-04-11 10:47 ` [PATCH 1/1] cred: copy_process() should clear child->replacement_session_keyring David Howells
1 sibling, 1 reply; 5+ messages in thread
From: Oleg Nesterov @ 2012-04-09 19:03 UTC (permalink / raw)
To: David Howells, Linus Torvalds; +Cc: Andrew Morton, linux-kernel, stable
keyctl_session_to_parent(task) sets ->replacement_session_keyring,
it should be processed and cleared by key_replace_session_keyring().
However, this task can fork before it notices TIF_NOTIFY_RESUME and
the new child gets the bogus ->replacement_session_keyring copied by
dup_task_struct(). This is obviously wrong and, if nothing else, this
leads to put_cred(already_freed_cred).
change copy_creds() to clear this member. If copy_process() fails
before this point the wrong ->replacement_session_keyring doesn't
matter, exit_creds() won't be called.
Cc: <stable@vger.kernel.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
---
kernel/cred.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/kernel/cred.c b/kernel/cred.c
index 97b36ee..e70683d 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -386,6 +386,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
struct cred *new;
int ret;
+ p->replacement_session_keyring = NULL;
+
if (
#ifdef CONFIG_KEYS
!p->cred->thread_keyring &&
--
1.5.5.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [RFC PATCH 0/1] task_work_queue: add generic process-context callbacks
2012-04-09 19:03 ` [PATCH 1/1] " Oleg Nesterov
@ 2012-04-10 1:05 ` Oleg Nesterov
2012-04-10 1:06 ` [RFC PATCH 1/1] " Oleg Nesterov
0 siblings, 1 reply; 5+ messages in thread
From: Oleg Nesterov @ 2012-04-10 1:05 UTC (permalink / raw)
To: David Howells, Linus Torvalds
Cc: Andrew Morton, linux-kernel, David Smith, Frank Ch. Eigler,
Larry Woodman, Peter Zijlstra, Tejun Heo
Hello.
I didn't read the "v3.4-rc2 out-of-memory problems" thread yet, but
I noticed how much Linus loves the
yet-another-random-notifier-for-some-random-reason idea.
Yet I am going to suggest another one, please see the patch.
But. To defence this change, please note that de-facto the notifier
is already here.
On 04/09, Oleg Nesterov wrote:
>
> Note: initially this was 1/2. The usage of >replacement_session_keyring
> is racy, although the problem is minor. I think that instead of fixing
> a lot of key_replace_session_keyring's callers in arch/ we can add the
> simple abstraction layer and kill ->replacement_session_keyring. I'll
> try to send the patches tomorrow.
Yes. the callers of key_replace_session_keyring() and
keyctl_session_to_parent() lack the barriers and can race with each other.
And keyctl_session_to_parent() probably needs kick_process(). Yes, the
problem is minor, but still.
To me, the main problem is task->->replacement_session_keyring itself.
I mean, imho it should not be that limited, we should generalize this
logic.
And potentially (I hope) it can have more users besides
KEYCTL_SESSION_TO_PARENT. Say, we can remove do_exit()->exit_irq_thread()
and task->irq_thread. The creator of irq thread can do
task_queue_work(exit_irq_thread).
What do you think?
Oleg.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [RFC PATCH 1/1] task_work_queue: add generic process-context callbacks
2012-04-10 1:05 ` [RFC PATCH 0/1] task_work_queue: add generic process-context callbacks Oleg Nesterov
@ 2012-04-10 1:06 ` Oleg Nesterov
0 siblings, 0 replies; 5+ messages in thread
From: Oleg Nesterov @ 2012-04-10 1:06 UTC (permalink / raw)
To: David Howells, Linus Torvalds
Cc: Andrew Morton, linux-kernel, David Smith, Frank Ch. Eigler,
Larry Woodman, Peter Zijlstra, Tejun Heo
Provide a simple mechanism that allows running code in the
(nonatomic) context of the arbitrary task.
The caller does task_work_queue(task, task_work) and this task
executes task_work->func() either from do_notify_resume() or
from do_exit(). The callback can rely on PF_EXITING to detect
the latter case.
"struct task_work" can be embedded in another struct, still it
has "void *data" to handle the most common/simple case.
This allows us to kill the ->replacement_session_keyring hack,
and potentially this can have more users.
Performance-wise, this adds 2 "unlikely(!hlist_empty())" checks
into tracehook_notify_resume() and do_exit(). But at the same
time we can remove the "replacement_session_keyring != NULL"
checks from arch/*/signal.c and exit_creds().
Note: task_work_queue/task_work_run abuses ->pi_lock. This is
only because this lock is already used by lookup_pi_state() to
synchronize with do_exit() setting PF_EXITING. Fortunately the
scope of this lock in task_work.c is really tiny, and the code
is unlikely anyway.
Todo:
- move clear_thread_flag(TIF_NOTIFY_RESUME) from arch/
to tracehook_notify_resume()
- rename tracehook_notify_resume() and move it into
linux/task_work.h
- m68k and xtensa don't have TIF_NOTIFY_RESUME and thus
they can't use this feature.
However, ->replacement_session_keyring equally needs
this logic, task_work_queue() is not worse.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
---
include/linux/sched.h | 2 +
include/linux/task_work.h | 39 +++++++++++++++++++++++++++++
include/linux/tracehook.h | 10 +++++++-
kernel/Makefile | 2 +-
kernel/exit.c | 5 +++-
kernel/fork.c | 1 +
kernel/task_work.c | 59 +++++++++++++++++++++++++++++++++++++++++++++
7 files changed, 115 insertions(+), 3 deletions(-)
create mode 100644 include/linux/task_work.h
create mode 100644 kernel/task_work.c
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 81a173c..be004ac 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1445,6 +1445,8 @@ struct task_struct {
int (*notifier)(void *priv);
void *notifier_data;
sigset_t *notifier_mask;
+ struct hlist_head task_works;
+
struct audit_context *audit_context;
#ifdef CONFIG_AUDITSYSCALL
uid_t loginuid;
diff --git a/include/linux/task_work.h b/include/linux/task_work.h
new file mode 100644
index 0000000..9fba177
--- /dev/null
+++ b/include/linux/task_work.h
@@ -0,0 +1,39 @@
+#ifndef _LINUX_TASK_WORK_H
+#define _LINUX_TASK_WORK_H 1
+
+#include <linux/sched.h>
+
+struct task_work {
+ struct hlist_node hlist;
+ void (*func)(struct task_work*);
+ void *data;
+};
+
+static inline void init_task_work(struct task_work *twork,
+ void (*func)(struct task_work*), void *data)
+{
+ twork->func = func;
+ twork->data = data;
+}
+
+#ifdef TIF_NOTIFY_RESUME
+int task_work_queue(struct task_struct *task, struct task_work *twork);
+void task_work_run(struct task_struct *task);
+#else
+static inline
+int task_work_queue(struct task_struct *task, struct task_work *twork)
+{
+ return -ENOTSUPP;
+}
+static inline void task_work_run(struct task_struct *task)
+{
+}
+#endif /* TIF_NOTIFY_RESUME */
+
+static inline void exit_task_work(struct task_struct *task)
+{
+ if (unlikely(!hlist_empty(&task->task_works)))
+ task_work_run(task);
+}
+
+#endif /* _LINUX_TASK_WORK_H */
diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
index 51bd91d..67dd262 100644
--- a/include/linux/tracehook.h
+++ b/include/linux/tracehook.h
@@ -46,7 +46,7 @@
#ifndef _LINUX_TRACEHOOK_H
#define _LINUX_TRACEHOOK_H 1
-#include <linux/sched.h>
+#include <linux/task_work.h>
#include <linux/ptrace.h>
#include <linux/security.h>
struct linux_binprm;
@@ -184,6 +184,14 @@ static inline void set_notify_resume(struct task_struct *task)
*/
static inline void tracehook_notify_resume(struct pt_regs *regs)
{
+ /*
+ * The caller just cleared TIF_NOTIFY_RESUME. This barrier
+ * pairs with task_work_queue()->set_notify_resume() after
+ * hlist_add_head(task->task_works);
+ */
+ smp_mb__after_clear_bit();
+ if (unlikely(!hlist_empty(¤t->task_works)))
+ task_work_run(current);
}
#endif /* TIF_NOTIFY_RESUME */
diff --git a/kernel/Makefile b/kernel/Makefile
index cb41b95..5790f8b 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -10,7 +10,7 @@ obj-y = fork.o exec_domain.o panic.o printk.o \
kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
notifier.o ksysfs.o cred.o \
- async.o range.o groups.o
+ async.o range.o groups.o task_work.o
ifdef CONFIG_FUNCTION_TRACER
# Do not trace debug files and internal ftrace files
diff --git a/kernel/exit.c b/kernel/exit.c
index d8bd3b4..dc852c2 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -946,11 +946,14 @@ void do_exit(long code)
exit_signals(tsk); /* sets PF_EXITING */
/*
* tsk->flags are checked in the futex code to protect against
- * an exiting task cleaning up the robust pi futexes.
+ * an exiting task cleaning up the robust pi futexes, and in
+ * task_work_queue() to avoid the race with exit_task_work().
*/
smp_mb();
raw_spin_unlock_wait(&tsk->pi_lock);
+ exit_task_work(tsk);
+
exit_irq_thread();
if (unlikely(in_atomic()))
diff --git a/kernel/fork.c b/kernel/fork.c
index b9372a0..d1108ac 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1380,6 +1380,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
*/
p->group_leader = p;
INIT_LIST_HEAD(&p->thread_group);
+ INIT_HLIST_HEAD(&p->task_works);
/* Now that the task is set up, run cgroup callbacks if
* necessary. We need to run them before the task is visible
diff --git a/kernel/task_work.c b/kernel/task_work.c
new file mode 100644
index 0000000..d8e2bcf
--- /dev/null
+++ b/kernel/task_work.c
@@ -0,0 +1,59 @@
+#include <linux/tracehook.h>
+
+#ifdef TIF_NOTIFY_RESUME
+int task_work_queue(struct task_struct *task, struct task_work *twork)
+{
+ unsigned long flags;
+ int err = -EINVAL;
+
+ /*
+ * We must not insert the new work if the task has already passed
+ * exit_task_work(). We rely on do_exit()->raw_spin_unlock_wait()
+ * and check PF_EXITING under pi_lock.
+ */
+ raw_spin_lock_irqsave(&task->pi_lock, flags);
+ if (likely(!(task->flags & PF_EXITING))) {
+ hlist_add_head(&twork->hlist, &task->task_works);
+ err = 0;
+ }
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+
+ /* test_and_set_bit() implies mb(), see tracehook_notify_resume(). */
+ if (likely(!err))
+ set_notify_resume(task);
+ return err;
+}
+
+void task_work_run(struct task_struct *task)
+{
+ unsigned long flags;
+ struct hlist_head task_works;
+ struct hlist_node *pos;
+
+ raw_spin_lock_irqsave(&task->pi_lock, flags);
+ hlist_move_list(&task->task_works, &task_works);
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+
+ if (WARN_ON(hlist_empty(&task_works)))
+ return;
+
+ /*
+ * We use hlist to save the space in task_struct, but we want fifo.
+ * Find the last entry, the list should be short, then process them
+ * in reverse order.
+ */
+ for (pos = task_works.first; pos->next ; pos = pos->next)
+ ;
+
+ for (;;) {
+ struct hlist_node **pprev = pos->pprev;
+ struct task_work *twork = container_of(pos, struct task_work,
+ hlist);
+ twork->func(twork);
+
+ if (pprev == &task_works.first)
+ break;
+ pos = container_of(pprev, struct hlist_node, next);
+ }
+}
+#endif /* TIF_NOTIFY_RESUME */
--
1.5.5.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 1/1] cred: copy_process() should clear child->replacement_session_keyring
2012-04-09 19:03 [PATCH 0/1] cred: copy_process() should clear child->replacement_session_keyring Oleg Nesterov
2012-04-09 19:03 ` [PATCH 1/1] " Oleg Nesterov
@ 2012-04-11 10:47 ` David Howells
1 sibling, 0 replies; 5+ messages in thread
From: David Howells @ 2012-04-11 10:47 UTC (permalink / raw)
To: Oleg Nesterov
Cc: dhowells, Linus Torvalds, Andrew Morton, linux-kernel, stable
Oleg Nesterov <oleg@redhat.com> wrote:
> keyctl_session_to_parent(task) sets ->replacement_session_keyring,
> it should be processed and cleared by key_replace_session_keyring().
>
> However, this task can fork before it notices TIF_NOTIFY_RESUME and
> the new child gets the bogus ->replacement_session_keyring copied by
> dup_task_struct(). This is obviously wrong and, if nothing else, this
> leads to put_cred(already_freed_cred).
>
> change copy_creds() to clear this member. If copy_process() fails
> before this point the wrong ->replacement_session_keyring doesn't
> matter, exit_creds() won't be called.
>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-04-11 10:47 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-04-09 19:03 [PATCH 0/1] cred: copy_process() should clear child->replacement_session_keyring Oleg Nesterov
2012-04-09 19:03 ` [PATCH 1/1] " Oleg Nesterov
2012-04-10 1:05 ` [RFC PATCH 0/1] task_work_queue: add generic process-context callbacks Oleg Nesterov
2012-04-10 1:06 ` [RFC PATCH 1/1] " Oleg Nesterov
2012-04-11 10:47 ` [PATCH 1/1] cred: copy_process() should clear child->replacement_session_keyring David Howells
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).