LKML Archive on lore.kernel.org
 help / Atom feed
* [PATCH v2] kernel: release ptraced tasks before zap_pid_ns_processes
@ 2019-01-10 17:52 Andrei Vagin
  2019-01-10 23:37 ` Andrew Morton
  0 siblings, 1 reply; 3+ messages in thread
From: Andrei Vagin @ 2019-01-10 17:52 UTC (permalink / raw)
  To: Andrew Morton, Oleg Nesterov
  Cc: linux-kernel, Andrei Vagin, Eric W. Biederman

Currently, exit_ptrace() adds all ptraced tasks in a dead list, than
zap_pid_ns_processes() waits all tasks in a current pidns, and only
then tasks from the dead list are released.

zap_pid_ns_processes() can stuck on waiting tasks from the dead list. In
this case, we will have one unkillable process with one or more dead
children.

Thanks to Oleg for the advice to release tasks in find_child_reaper().

Fixes: 7c8bd2322c7f ("exit: ptrace: shift "reap dead" code from exit_ptrace() to forget_original_parent()")

Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>
---

v2: Oleg showed that ptraced tasks can be released in
find_child_reaper(). This allows to avoid additional
write_lock/unlock(tasklist), and another list_for_each_entry_safe(dead)
loop is called only if it is actually needed.

 kernel/exit.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/kernel/exit.c b/kernel/exit.c
index 2d14979577ee..5df787a497f5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -558,12 +558,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p)
 	return NULL;
 }
 
-static struct task_struct *find_child_reaper(struct task_struct *father)
+static struct task_struct *find_child_reaper(struct task_struct *father,
+						struct list_head *dead)
 	__releases(&tasklist_lock)
 	__acquires(&tasklist_lock)
 {
 	struct pid_namespace *pid_ns = task_active_pid_ns(father);
 	struct task_struct *reaper = pid_ns->child_reaper;
+	struct task_struct *p, *n;
 
 	if (likely(reaper != father))
 		return reaper;
@@ -579,6 +581,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father)
 		panic("Attempted to kill init! exitcode=0x%08x\n",
 			father->signal->group_exit_code ?: father->exit_code);
 	}
+
+	list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+		list_del_init(&p->ptrace_entry);
+		release_task(p);
+	}
+
 	zap_pid_ns_processes(pid_ns);
 	write_lock_irq(&tasklist_lock);
 
@@ -668,7 +676,7 @@ static void forget_original_parent(struct task_struct *father,
 		exit_ptrace(father, dead);
 
 	/* Can drop and reacquire tasklist_lock */
-	reaper = find_child_reaper(father);
+	reaper = find_child_reaper(father, dead);
 	if (list_empty(&father->children))
 		return;
 
-- 
2.17.2


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] kernel: release ptraced tasks before zap_pid_ns_processes
  2019-01-10 17:52 [PATCH v2] kernel: release ptraced tasks before zap_pid_ns_processes Andrei Vagin
@ 2019-01-10 23:37 ` Andrew Morton
  2019-01-11 15:39   ` Oleg Nesterov
  0 siblings, 1 reply; 3+ messages in thread
From: Andrew Morton @ 2019-01-10 23:37 UTC (permalink / raw)
  To: Andrei Vagin; +Cc: Oleg Nesterov, linux-kernel, Eric W. Biederman

On Thu, 10 Jan 2019 09:52:00 -0800 Andrei Vagin <avagin@gmail.com> wrote:

> Currently, exit_ptrace() adds all ptraced tasks in a dead list, than
> zap_pid_ns_processes() waits all tasks in a current pidns, and only
> then tasks from the dead list are released.
> 
> zap_pid_ns_processes() can stuck on waiting tasks from the dead list. In
> this case, we will have one unkillable process with one or more dead
> children.
> 
> Thanks to Oleg for the advice to release tasks in find_child_reaper().
> 
> Fixes: 7c8bd2322c7f ("exit: ptrace: shift "reap dead" code from exit_ptrace() to forget_original_parent()")
> 
> Cc: "Eric W. Biederman" <ebiederm@xmission.com>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Oleg Nesterov <oleg@redhat.com>
> Signed-off-by: Andrei Vagin <avagin@gmail.com>

Does this warrant a -stable backport?  7c8bd2322c7f was 4+ years ago...

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] kernel: release ptraced tasks before zap_pid_ns_processes
  2019-01-10 23:37 ` Andrew Morton
@ 2019-01-11 15:39   ` Oleg Nesterov
  0 siblings, 0 replies; 3+ messages in thread
From: Oleg Nesterov @ 2019-01-11 15:39 UTC (permalink / raw)
  To: Andrew Morton; +Cc: Andrei Vagin, linux-kernel, Eric W. Biederman

On 01/10, Andrew Morton wrote:
>
> > Fixes: 7c8bd2322c7f ("exit: ptrace: shift "reap dead" code from exit_ptrace() to forget_original_parent()")
> >
> > Cc: "Eric W. Biederman" <ebiederm@xmission.com>
> > Cc: Andrew Morton <akpm@linux-foundation.org>
> > Signed-off-by: Oleg Nesterov <oleg@redhat.com>
> > Signed-off-by: Andrei Vagin <avagin@gmail.com>
>
> Does this warrant a -stable backport?  7c8bd2322c7f was 4+ years ago...

Agreed, the problem is trivially reproducible.

Oleg.


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-10 17:52 [PATCH v2] kernel: release ptraced tasks before zap_pid_ns_processes Andrei Vagin
2019-01-10 23:37 ` Andrew Morton
2019-01-11 15:39   ` Oleg Nesterov

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org linux-kernel@archiver.kernel.org
	public-inbox-index lkml


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox