[PATCH v6 1/2] fork: extend clone3() to support setting a PID

[PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Adrian Reber]

The main motivation to add set_tid to clone3() is CRIU.

To restore a process with the same PID/TID CRIU currently uses
/proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
ns_last_pid and then (quickly) does a clone(). This works most of the
time, but it is racy. It is also slow as it requires multiple syscalls.

Extending clone3() to support set_tid makes it possible restore a
process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
race free (as long as the desired PID/TID is available).

This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
on clone3() with set_tid as they are currently in place for ns_last_pid.

Signed-off-by: Adrian Reber <areber@redhat.com>
---
v2:
 - Removed (size < sizeof(struct clone_args)) as discussed with
   Christian and Dmitry
 - Added comment to ((set_tid != 1) && idr_get_cursor() <= 1) (Oleg)
 - Use idr_alloc() instead of idr_alloc_cyclic() (Oleg)

v3:
 - Return EEXIST if PID is already in use (Christian)
 - Drop CLONE_SET_TID (Christian and Oleg)
 - Use idr_is_empty() instead of idr_get_cursor() (Oleg)
 - Handle different `struct clone_args` sizes (Dmitry)

v4:
 - Rework struct size check with defines (Christian)
 - Reduce number of set_tid checks (Oleg)
 - Less parentheses and more robust code (Oleg)
 - Do ns_capable() on correct user_ns (Oleg, Christian)

v5:
 - make set_tid checks earlier in alloc_pid() (Christian)
 - remove unnecessary comment and struct size check (Christian)

v6:
 - remove CLONE_SET_TID from description (Christian)
 - add clone3() tests for different clone_args sizes (Christian)
 - move more set_tid checks to alloc_pid() (Oleg)
 - make all set_tid checks lockless (Oleg)
---
 include/linux/pid.h        |  2 +-
 include/linux/sched/task.h |  1 +
 include/uapi/linux/sched.h |  1 +
 kernel/fork.c              | 14 ++++++++++++--
 kernel/pid.c               | 37 ++++++++++++++++++++++++++++++-------
 5 files changed, 45 insertions(+), 10 deletions(-)

diff --git a/include/linux/pid.h b/include/linux/pid.h
index 2a83e434db9d..052000db0ced 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -116,7 +116,7 @@ extern struct pid *find_vpid(int nr);
 extern struct pid *find_get_pid(int nr);
 extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
 
-extern struct pid *alloc_pid(struct pid_namespace *ns);
+extern struct pid *alloc_pid(struct pid_namespace *ns, pid_t set_tid);
 extern void free_pid(struct pid *pid);
 extern void disable_pid_allocation(struct pid_namespace *ns);
 
diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
index 0497091e40c1..4f2a80564332 100644
--- a/include/linux/sched/task.h
+++ b/include/linux/sched/task.h
@@ -26,6 +26,7 @@ struct kernel_clone_args {
 	unsigned long stack;
 	unsigned long stack_size;
 	unsigned long tls;
+	pid_t set_tid;
 };
 
 /*
diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
index b3105ac1381a..e1ce103a2c47 100644
--- a/include/uapi/linux/sched.h
+++ b/include/uapi/linux/sched.h
@@ -45,6 +45,7 @@ struct clone_args {
 	__aligned_u64 stack;
 	__aligned_u64 stack_size;
 	__aligned_u64 tls;
+	__aligned_u64 set_tid;
 };
 
 /*
diff --git a/kernel/fork.c b/kernel/fork.c
index 2852d0e76ea3..8317d408a8d6 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -117,6 +117,11 @@
  */
 #define MAX_THREADS FUTEX_TID_MASK
 
+/*
+ * For different sizes of struct clone_args
+ */
+#define CLONE3_ARGS_SIZE_V0 64
+
 /*
  * Protected counters by write_lock_irq(&tasklist_lock)
  */
@@ -2031,7 +2036,7 @@ static __latent_entropy struct task_struct *copy_process(
 	stackleak_task_init(p);
 
 	if (pid != &init_struct_pid) {
-		pid = alloc_pid(p->nsproxy->pid_ns_for_children);
+		pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid);
 		if (IS_ERR(pid)) {
 			retval = PTR_ERR(pid);
 			goto bad_fork_cleanup_thread;
@@ -2535,9 +2540,13 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
 	if (unlikely(size > PAGE_SIZE))
 		return -E2BIG;
 
-	if (unlikely(size < sizeof(struct clone_args)))
+	if (unlikely(size < CLONE3_ARGS_SIZE_V0))
 		return -EINVAL;
 
+	if (size < sizeof(struct clone_args))
+		memset((void *)&args + size, 0,
+				sizeof(struct clone_args) - size);
+
 	if (unlikely(!access_ok(uargs, size)))
 		return -EFAULT;
 
@@ -2571,6 +2580,7 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
 		.stack		= args.stack,
 		.stack_size	= args.stack_size,
 		.tls		= args.tls,
+		.set_tid	= args.set_tid,
 	};
 
 	return 0;
diff --git a/kernel/pid.c b/kernel/pid.c
index 0a9f2e437217..5cdab73b9094 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -157,7 +157,7 @@ void free_pid(struct pid *pid)
 	call_rcu(&pid->rcu, delayed_put_pid);
 }
 
-struct pid *alloc_pid(struct pid_namespace *ns)
+struct pid *alloc_pid(struct pid_namespace *ns, int set_tid)
 {
 	struct pid *pid;
 	enum pid_type type;
@@ -166,6 +166,16 @@ struct pid *alloc_pid(struct pid_namespace *ns)
 	struct upid *upid;
 	int retval = -ENOMEM;
 
+	if (set_tid) {
+		if (set_tid < 0 || set_tid >= pid_max)
+			return ERR_PTR(-EINVAL);
+		/* Also fail if a PID != 1 is requested and no PID 1 exists */
+		if (set_tid != 1 && !ns->child_reaper)
+			return ERR_PTR(-EINVAL);
+		if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+			return ERR_PTR(-EPERM);
+	}
+
 	pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
 	if (!pid)
 		return ERR_PTR(retval);
@@ -186,12 +196,25 @@ struct pid *alloc_pid(struct pid_namespace *ns)
 		if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
 			pid_min = RESERVED_PIDS;
 
-		/*
-		 * Store a null pointer so find_pid_ns does not find
-		 * a partially initialized PID (see below).
-		 */
-		nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
-				      pid_max, GFP_ATOMIC);
+		if (set_tid) {
+			nr = idr_alloc(&tmp->idr, NULL, set_tid,
+					set_tid + 1, GFP_ATOMIC);
+			/*
+			 * If ENOSPC is returned it means that the PID is
+			 * alreay in use. Return EEXIST in that case.
+			 */
+			if (nr == -ENOSPC)
+				nr = -EEXIST;
+			/* Only use set_tid for one PID namespace. */
+			set_tid = 0;
+		} else {
+			/*
+			 * Store a null pointer so find_pid_ns does not find
+			 * a partially initialized PID (see below).
+			 */
+			nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
+					      pid_max, GFP_ATOMIC);
+		}
 		spin_unlock_irq(&pidmap_lock);
 		idr_preload_end();
 
-- 
2.21.0

[PATCH v6 2/2] selftests: add tests for clone3()

[Adrian Reber]

This tests clone3() with and without set_tid to see if all desired PIDs
are working as expected. The test tries to clone3() with a set_tid of
-1, 1, pid_max, a PID which is already in use and an unused PID. The
same tests are also running in PID namespace.

In addition the clone3 test (without set_tid) tries to call clone3()
with different sizes of clone_args.

Signed-off-by: Adrian Reber <areber@redhat.com>
---
 tools/testing/selftests/clone3/.gitignore     |   2 +
 tools/testing/selftests/clone3/Makefile       |  11 +
 tools/testing/selftests/clone3/clone3.c       | 231 ++++++++++++++++++
 .../testing/selftests/clone3/clone3_set_tid.c | 161 ++++++++++++
 4 files changed, 405 insertions(+)
 create mode 100644 tools/testing/selftests/clone3/.gitignore
 create mode 100644 tools/testing/selftests/clone3/Makefile
 create mode 100644 tools/testing/selftests/clone3/clone3.c
 create mode 100644 tools/testing/selftests/clone3/clone3_set_tid.c

diff --git a/tools/testing/selftests/clone3/.gitignore b/tools/testing/selftests/clone3/.gitignore
new file mode 100644
index 000000000000..c63c64a78ddf
--- /dev/null
+++ b/tools/testing/selftests/clone3/.gitignore
@@ -0,0 +1,2 @@
+clone3_set_tid
+clone3
diff --git a/tools/testing/selftests/clone3/Makefile b/tools/testing/selftests/clone3/Makefile
new file mode 100644
index 000000000000..4efcf45b995b
--- /dev/null
+++ b/tools/testing/selftests/clone3/Makefile
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0
+uname_M := $(shell uname -m 2>/dev/null || echo not)
+ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/)
+
+CFLAGS += -I../../../../usr/include/
+
+ifeq ($(ARCH),x86_64)
+	TEST_GEN_PROGS := clone3 clone3_set_tid
+endif
+
+include ../lib.mk
diff --git a/tools/testing/selftests/clone3/clone3.c b/tools/testing/selftests/clone3/clone3.c
new file mode 100644
index 000000000000..a0f1989f8b1b
--- /dev/null
+++ b/tools/testing/selftests/clone3/clone3.c
@@ -0,0 +1,231 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/* Based on Christian Brauner's clone3() example */
+
+#define _GNU_SOURCE
+#include <errno.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <sched.h>
+
+#include "../kselftest.h"
+
+/*
+ * Different sizes of struct clone_args
+ */
+#define CLONE3_ARGS_SIZE_V0 64
+/* V1 includes set_tid */
+#define CLONE3_ARGS_SIZE_V1 72
+
+#define CLONE3_ARGS_NO_TEST 0
+#define CLONE3_ARGS_ALL_0 1
+#define CLONE3_ARGS_ALL_1 2
+
+static pid_t raw_clone(struct clone_args *args, size_t size)
+{
+	return syscall(__NR_clone3, args, size);
+}
+
+static int call_clone3(int flags, size_t size, int test_mode)
+{
+	struct clone_args args = {0};
+	pid_t ppid = -1;
+	pid_t pid = -1;
+	int status;
+
+	args.flags = flags;
+	args.exit_signal = SIGCHLD;
+
+	if (size == 0)
+		size = sizeof(struct clone_args);
+
+	if (test_mode == CLONE3_ARGS_ALL_0) {
+		args.flags = 0;
+		args.pidfd = 0;
+		args.child_tid = 0;
+		args.parent_tid = 0;
+		args.exit_signal = 0;
+		args.stack = 0;
+		args. stack_size = 0;
+		args.tls = 0;
+		args.set_tid = 0;
+	} else if (test_mode == CLONE3_ARGS_ALL_1) {
+		args.flags = 1;
+		args.pidfd = 1;
+		args.child_tid = 1;
+		args.parent_tid = 1;
+		args.exit_signal = 1;
+		args.stack = 1;
+		args. stack_size = 1;
+		args.tls = 1;
+		args.set_tid = 1;
+	}
+
+	pid = raw_clone(&args, size);
+	if (pid < 0) {
+		ksft_print_msg("%s - Failed to create new process\n",
+				strerror(errno));
+		return -errno;
+	}
+
+	if (pid == 0) {
+		ksft_print_msg("I am the child, my PID is %d\n", getpid());
+		_exit(EXIT_SUCCESS);
+	}
+
+	ppid = getpid();
+	ksft_print_msg("I am the parent (%d). My child's pid is %d\n",
+			ppid, pid);
+
+	(void)wait(&status);
+	if (WEXITSTATUS(status))
+		return WEXITSTATUS(status);
+
+	return 0;
+}
+
+static int test_clone3(int flags, size_t size, int expected, int test_mode)
+{
+	int ret;
+
+	ksft_print_msg("[%d] Trying clone3() with flags 0x%x (size %d)\n",
+			getpid(), flags, size);
+	ret = call_clone3(flags, size, test_mode);
+	ksft_print_msg("[%d] clone3() with flags says :%d expected %d\n",
+			getpid(), ret, expected);
+	if (ret != expected)
+		ksft_exit_fail_msg(
+			"[%d] Result (%d) is different than expected (%d)\n",
+			getpid(), ret, expected);
+	ksft_test_result_pass("[%d] Result (%d) matches expectation (%d)\n",
+			getpid(), ret, expected);
+	return 0;
+}
+int main(int argc, char *argv[])
+{
+	int ret = -1;
+	pid_t pid;
+
+	ksft_print_header();
+	ksft_set_plan(16);
+
+	/* Just a simple clone3() should return 0.*/
+	if (test_clone3(0, 0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() in a new PID NS.*/
+	if (test_clone3(CLONE_NEWPID, 0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with CLONE3_ARGS_SIZE_V0. */
+	if (test_clone3(0, CLONE3_ARGS_SIZE_V0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with CLONE3_ARGS_SIZE_V1. */
+	if (test_clone3(0, CLONE3_ARGS_SIZE_V0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with CLONE3_ARGS_SIZE_V0 - 8 */
+	if (test_clone3(0, CLONE3_ARGS_SIZE_V0 - 8, -EINVAL,
+				CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with sizeof(struct clone_args) + 8 */
+	if (test_clone3(0, sizeof(struct clone_args) + 8, -E2BIG,
+				CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with all members set to 1 */
+	if (test_clone3(0, CLONE3_ARGS_SIZE_V0, -EINVAL, CLONE3_ARGS_ALL_1))
+		goto on_error;
+	/*
+	 * Do a clone3() with sizeof(struct clone_args) + 8
+	 * and all members set to 0.
+	 */
+	if (test_clone3(0, sizeof(struct clone_args) + 8, -E2BIG,
+				CLONE3_ARGS_ALL_0))
+		goto on_error;
+	/*
+	 * Do a clone3() with sizeof(struct clone_args) + 8
+	 * and all members set to 0.
+	 */
+	if (test_clone3(0, sizeof(struct clone_args) + 8, -E2BIG,
+				CLONE3_ARGS_ALL_1))
+		goto on_error;
+	/* Do a clone3() with > page size */
+	if (test_clone3(0, getpagesize() + 8, -E2BIG, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with CLONE3_ARGS_SIZE_V0 in a new PID NS. */
+	if (test_clone3(CLONE_NEWPID, CLONE3_ARGS_SIZE_V0, 0,
+				CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with CLONE3_ARGS_SIZE_V1 in a new PID NS. */
+	if (test_clone3(CLONE_NEWPID, CLONE3_ARGS_SIZE_V0, 0,
+				CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with CLONE3_ARGS_SIZE_V0 - 8 in a new PID NS */
+	if (test_clone3(CLONE_NEWPID, CLONE3_ARGS_SIZE_V0 - 8, -EINVAL,
+				CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with sizeof(struct clone_args) + 8 in a new PID NS */
+	if (test_clone3(CLONE_NEWPID, sizeof(struct clone_args) + 8, -E2BIG,
+				CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	/* Do a clone3() with > page size in a new PID NS */
+	if (test_clone3(CLONE_NEWPID, getpagesize() + 8, -E2BIG,
+				CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	ksft_print_msg("First unshare\n");
+	if (unshare(CLONE_NEWPID))
+		goto on_error;
+	/*
+	 * Before clone3()ing in a new PID NS with
+	 * CLONE_NEWPID a fork() is necessary.
+	 */
+	if (test_clone3(CLONE_NEWPID, 0, -EINVAL, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	pid = fork();
+	if (pid < 0) {
+		ksft_print_msg("First fork() failed\n");
+		goto on_error;
+	}
+	if (pid > 0) {
+		(void)wait(NULL);
+		goto parent_out;
+	}
+	ksft_set_plan(19);
+	if (test_clone3(CLONE_NEWPID, 0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	if (test_clone3(0, 0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	ksft_print_msg("Second unshare\n");
+	if (unshare(CLONE_NEWPID))
+		goto on_error;
+	/*
+	 * Before clone3()ing in a new PID NS with
+	 * CLONE_NEWPID a fork() is necessary.
+	 */
+	if (test_clone3(CLONE_NEWPID, 0, -EINVAL, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	pid = fork();
+	if (pid < 0) {
+		ksft_print_msg("Second fork() failed\n");
+		goto on_error;
+	}
+	if (pid > 0) {
+		(void)wait(NULL);
+		goto parent_out;
+	}
+	ksft_set_plan(21);
+	if (test_clone3(CLONE_NEWPID, 0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+	if (test_clone3(0, 0, 0, CLONE3_ARGS_NO_TEST))
+		goto on_error;
+
+parent_out:
+	ret = 0;
+on_error:
+
+	return !ret ? ksft_exit_pass() : ksft_exit_fail();
+}
diff --git a/tools/testing/selftests/clone3/clone3_set_tid.c b/tools/testing/selftests/clone3/clone3_set_tid.c
new file mode 100644
index 000000000000..f5012e84dcb3
--- /dev/null
+++ b/tools/testing/selftests/clone3/clone3_set_tid.c
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/* Based on Christian Brauner's clone3() example */
+
+#define _GNU_SOURCE
+#include <errno.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <sched.h>
+
+#include "../kselftest.h"
+
+static pid_t raw_clone(struct clone_args *args)
+{
+	return syscall(__NR_clone3, args, sizeof(struct clone_args));
+}
+
+static int call_clone3_set_tid(int set_tid, int flags)
+{
+	struct clone_args args = {0};
+	pid_t ppid = -1;
+	pid_t pid = -1;
+	int status;
+
+	args.flags = flags;
+	args.exit_signal = SIGCHLD;
+	args.set_tid = set_tid;
+
+	pid = raw_clone(&args);
+	if (pid < 0) {
+		ksft_print_msg("%s - Failed to create new process\n",
+				strerror(errno));
+		return -errno;
+	}
+
+	if (pid == 0) {
+		ksft_print_msg("I am the child, my PID is %d (expected %d)\n",
+				getpid(), set_tid);
+		if (set_tid != getpid())
+			_exit(EXIT_FAILURE);
+		_exit(EXIT_SUCCESS);
+	}
+
+	ppid = getpid();
+	ksft_print_msg("I am the parent (%d). My child's pid is %d\n",
+			ppid, pid);
+
+	(void)wait(&status);
+	if (WEXITSTATUS(status))
+		return WEXITSTATUS(status);
+
+	return 0;
+}
+
+static int test_clone3_set_tid(int set_tid, int flags, int expected)
+{
+	int ret;
+
+	ksft_print_msg(
+		"[%d] Trying clone3() with CLONE_SET_TID to %d and 0x%x\n",
+		getpid(), set_tid, flags);
+	ret = call_clone3_set_tid(set_tid, flags);
+	ksft_print_msg(
+		"[%d] clone3() with CLONE_SET_TID %d says :%d - expected %d\n",
+		getpid(), set_tid, ret, expected);
+	if (ret != expected)
+		ksft_exit_fail_msg(
+			"[%d] Result (%d) is different than expected (%d)\n",
+			getpid(), ret, expected);
+	ksft_test_result_pass("[%d] Result (%d) matches expectation (%d)\n",
+			getpid(), ret, expected);
+	return 0;
+}
+int main(int argc, char *argv[])
+{
+	FILE *f;
+	int pid_max = 0;
+	pid_t pid;
+	pid_t ns_pid;
+	int ret = -1;
+
+	ksft_print_header();
+	ksft_set_plan(13);
+
+	f = fopen("/proc/sys/kernel/pid_max", "r");
+	if (f == NULL)
+		ksft_exit_fail_msg(
+			"%s - Could not open /proc/sys/kernel/pid_max\n",
+			strerror(errno));
+	fscanf(f, "%d", &pid_max);
+	fclose(f);
+	ksft_print_msg("/proc/sys/kernel/pid_max %d\n", pid_max);
+
+	/* First try with an invalid PID */
+	if (test_clone3_set_tid(-1, 0, -EINVAL))
+		goto on_error;
+	if (test_clone3_set_tid(-1, CLONE_NEWPID, -EINVAL))
+		goto on_error;
+	/* Then with PID 1 */
+	if (test_clone3_set_tid(1, 0, -EEXIST))
+		goto on_error;
+	/* PID 1 should not fail in a PID namespace */
+	if (test_clone3_set_tid(1, CLONE_NEWPID, 0))
+		goto on_error;
+	/* pid_max should fail everywhere */
+	if (test_clone3_set_tid(pid_max, 0, -EINVAL))
+		goto on_error;
+	if (test_clone3_set_tid(pid_max, CLONE_NEWPID, -EINVAL))
+		goto on_error;
+	/* Find the current active PID */
+	pid = fork();
+	if (pid == 0) {
+		ksft_print_msg("Child has PID %d\n", getpid());
+		sleep(1);
+		_exit(EXIT_SUCCESS);
+	}
+	/* Try to create a process with that PID should fail */
+	if (test_clone3_set_tid(pid, 0, -EEXIST))
+		goto on_error;
+	(void)wait(NULL);
+	/* After the child has finished, try again with the same PID */
+	if (test_clone3_set_tid(pid, 0, 0))
+		goto on_error;
+	/* This should fail as there is no PID 1 in that namespace */
+	if (test_clone3_set_tid(pid, CLONE_NEWPID, -EINVAL))
+		goto on_error;
+	unshare(CLONE_NEWPID);
+	if (test_clone3_set_tid(10, 0, -EINVAL))
+		goto on_error;
+	/* Let's create a PID 1 */
+	ns_pid = fork();
+	if (ns_pid == 0) {
+		ksft_print_msg("Child in PID namespace has PID %d\n", getpid());
+		sleep(1);
+		_exit(EXIT_SUCCESS);
+	}
+	/*
+	 * Now, after the unshare() it should be possible to create a process
+	 * with another ID than 1 in the PID namespace.
+	 */
+	if (test_clone3_set_tid(2, 0, 0))
+		goto on_error;
+	/* Use a different PID in this namespace. */
+	if (test_clone3_set_tid(2222, 0, 0))
+		goto on_error;
+	if (test_clone3_set_tid(1, 0, -EEXIST))
+		goto on_error;
+	(void)wait(NULL);
+
+	ret = 0;
+on_error:
+
+	return !ret ? ksft_exit_pass() : ksft_exit_fail();
+}
-- 
2.21.0

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Andrei Vagin]

On Mon, Aug 12, 2019 at 1:10 PM Adrian Reber <areber@redhat.com> wrote:
>
> The main motivation to add set_tid to clone3() is CRIU.
>
> To restore a process with the same PID/TID CRIU currently uses
> /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> ns_last_pid and then (quickly) does a clone(). This works most of the
> time, but it is racy. It is also slow as it requires multiple syscalls.
>
> Extending clone3() to support set_tid makes it possible restore a
> process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> race free (as long as the desired PID/TID is available).
>
> This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> on clone3() with set_tid as they are currently in place for ns_last_pid.
>
> Signed-off-by: Adrian Reber <areber@redhat.com>
> ---
> v2:
>  - Removed (size < sizeof(struct clone_args)) as discussed with
>    Christian and Dmitry
>  - Added comment to ((set_tid != 1) && idr_get_cursor() <= 1) (Oleg)
>  - Use idr_alloc() instead of idr_alloc_cyclic() (Oleg)
>
> v3:
>  - Return EEXIST if PID is already in use (Christian)
>  - Drop CLONE_SET_TID (Christian and Oleg)
>  - Use idr_is_empty() instead of idr_get_cursor() (Oleg)
>  - Handle different `struct clone_args` sizes (Dmitry)
>
> v4:
>  - Rework struct size check with defines (Christian)
>  - Reduce number of set_tid checks (Oleg)
>  - Less parentheses and more robust code (Oleg)
>  - Do ns_capable() on correct user_ns (Oleg, Christian)
>
> v5:
>  - make set_tid checks earlier in alloc_pid() (Christian)
>  - remove unnecessary comment and struct size check (Christian)
>
> v6:
>  - remove CLONE_SET_TID from description (Christian)
>  - add clone3() tests for different clone_args sizes (Christian)
>  - move more set_tid checks to alloc_pid() (Oleg)
>  - make all set_tid checks lockless (Oleg)
> ---
>  include/linux/pid.h        |  2 +-
>  include/linux/sched/task.h |  1 +
>  include/uapi/linux/sched.h |  1 +
>  kernel/fork.c              | 14 ++++++++++++--
>  kernel/pid.c               | 37 ++++++++++++++++++++++++++++++-------
>  5 files changed, 45 insertions(+), 10 deletions(-)
>
> diff --git a/include/linux/pid.h b/include/linux/pid.h
> index 2a83e434db9d..052000db0ced 100644
> --- a/include/linux/pid.h
> +++ b/include/linux/pid.h
> @@ -116,7 +116,7 @@ extern struct pid *find_vpid(int nr);
>  extern struct pid *find_get_pid(int nr);
>  extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
>
> -extern struct pid *alloc_pid(struct pid_namespace *ns);
> +extern struct pid *alloc_pid(struct pid_namespace *ns, pid_t set_tid);
>  extern void free_pid(struct pid *pid);
>  extern void disable_pid_allocation(struct pid_namespace *ns);
>
> diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
> index 0497091e40c1..4f2a80564332 100644
> --- a/include/linux/sched/task.h
> +++ b/include/linux/sched/task.h
> @@ -26,6 +26,7 @@ struct kernel_clone_args {
>         unsigned long stack;
>         unsigned long stack_size;
>         unsigned long tls;
> +       pid_t set_tid;
>  };
>
>  /*
> diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
> index b3105ac1381a..e1ce103a2c47 100644
> --- a/include/uapi/linux/sched.h
> +++ b/include/uapi/linux/sched.h
> @@ -45,6 +45,7 @@ struct clone_args {
>         __aligned_u64 stack;
>         __aligned_u64 stack_size;
>         __aligned_u64 tls;
> +       __aligned_u64 set_tid;
>  };
>
>  /*
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 2852d0e76ea3..8317d408a8d6 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -117,6 +117,11 @@
>   */
>  #define MAX_THREADS FUTEX_TID_MASK
>
> +/*
> + * For different sizes of struct clone_args
> + */
> +#define CLONE3_ARGS_SIZE_V0 64
> +
>  /*
>   * Protected counters by write_lock_irq(&tasklist_lock)
>   */
> @@ -2031,7 +2036,7 @@ static __latent_entropy struct task_struct *copy_process(
>         stackleak_task_init(p);
>
>         if (pid != &init_struct_pid) {
> -               pid = alloc_pid(p->nsproxy->pid_ns_for_children);
> +               pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid);
>                 if (IS_ERR(pid)) {
>                         retval = PTR_ERR(pid);
>                         goto bad_fork_cleanup_thread;
> @@ -2535,9 +2540,13 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
>         if (unlikely(size > PAGE_SIZE))
>                 return -E2BIG;
>
> -       if (unlikely(size < sizeof(struct clone_args)))
> +       if (unlikely(size < CLONE3_ARGS_SIZE_V0))
>                 return -EINVAL;
>
> +       if (size < sizeof(struct clone_args))
> +               memset((void *)&args + size, 0,
> +                               sizeof(struct clone_args) - size);
> +
>         if (unlikely(!access_ok(uargs, size)))
>                 return -EFAULT;
>
> @@ -2571,6 +2580,7 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
>                 .stack          = args.stack,
>                 .stack_size     = args.stack_size,
>                 .tls            = args.tls,
> +               .set_tid        = args.set_tid,
>         };
>
>         return 0;
> diff --git a/kernel/pid.c b/kernel/pid.c
> index 0a9f2e437217..5cdab73b9094 100644
> --- a/kernel/pid.c
> +++ b/kernel/pid.c
> @@ -157,7 +157,7 @@ void free_pid(struct pid *pid)
>         call_rcu(&pid->rcu, delayed_put_pid);
>  }
>
> -struct pid *alloc_pid(struct pid_namespace *ns)
> +struct pid *alloc_pid(struct pid_namespace *ns, int set_tid)
>  {
>         struct pid *pid;
>         enum pid_type type;
> @@ -166,6 +166,16 @@ struct pid *alloc_pid(struct pid_namespace *ns)
>         struct upid *upid;
>         int retval = -ENOMEM;
>
> +       if (set_tid) {
> +               if (set_tid < 0 || set_tid >= pid_max)
> +                       return ERR_PTR(-EINVAL);
> +               /* Also fail if a PID != 1 is requested and no PID 1 exists */
> +               if (set_tid != 1 && !ns->child_reaper)
> +                       return ERR_PTR(-EINVAL);

What will happen if I will create a new pid namespace
(unsahre(CLONE_NEWPID)) and then call clone3 with tid which isn't
equal to 1?

Will I get the init process with the 5 pid?...

> +               if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> +                       return ERR_PTR(-EPERM);
> +       }
> +
>         pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
>         if (!pid)
>                 return ERR_PTR(retval);
> @@ -186,12 +196,25 @@ struct pid *alloc_pid(struct pid_namespace *ns)
>                 if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
>                         pid_min = RESERVED_PIDS;
>
> -               /*
> -                * Store a null pointer so find_pid_ns does not find
> -                * a partially initialized PID (see below).
> -                */
> -               nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> -                                     pid_max, GFP_ATOMIC);
> +               if (set_tid) {
> +                       nr = idr_alloc(&tmp->idr, NULL, set_tid,
> +                                       set_tid + 1, GFP_ATOMIC);
> +                       /*
> +                        * If ENOSPC is returned it means that the PID is
> +                        * alreay in use. Return EEXIST in that case.
> +                        */
> +                       if (nr == -ENOSPC)
> +                               nr = -EEXIST;
> +                       /* Only use set_tid for one PID namespace. */
> +                       set_tid = 0;
> +               } else {
> +                       /*
> +                        * Store a null pointer so find_pid_ns does not find
> +                        * a partially initialized PID (see below).
> +                        */
> +                       nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> +                                             pid_max, GFP_ATOMIC);
> +               }
>                 spin_unlock_irq(&pidmap_lock);
>                 idr_preload_end();
>
> --
> 2.21.0
>

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Adrian Reber]

On Mon, Aug 12, 2019 at 01:43:53PM -0700, Andrei Vagin wrote:
> On Mon, Aug 12, 2019 at 1:10 PM Adrian Reber <areber@redhat.com> wrote:
> >
> > The main motivation to add set_tid to clone3() is CRIU.
> >
> > To restore a process with the same PID/TID CRIU currently uses
> > /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> > ns_last_pid and then (quickly) does a clone(). This works most of the
> > time, but it is racy. It is also slow as it requires multiple syscalls.
> >
> > Extending clone3() to support set_tid makes it possible restore a
> > process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> > race free (as long as the desired PID/TID is available).
> >
> > This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> > on clone3() with set_tid as they are currently in place for ns_last_pid.
> >
> > Signed-off-by: Adrian Reber <areber@redhat.com>
> > ---
> > v2:
> >  - Removed (size < sizeof(struct clone_args)) as discussed with
> >    Christian and Dmitry
> >  - Added comment to ((set_tid != 1) && idr_get_cursor() <= 1) (Oleg)
> >  - Use idr_alloc() instead of idr_alloc_cyclic() (Oleg)
> >
> > v3:
> >  - Return EEXIST if PID is already in use (Christian)
> >  - Drop CLONE_SET_TID (Christian and Oleg)
> >  - Use idr_is_empty() instead of idr_get_cursor() (Oleg)
> >  - Handle different `struct clone_args` sizes (Dmitry)
> >
> > v4:
> >  - Rework struct size check with defines (Christian)
> >  - Reduce number of set_tid checks (Oleg)
> >  - Less parentheses and more robust code (Oleg)
> >  - Do ns_capable() on correct user_ns (Oleg, Christian)
> >
> > v5:
> >  - make set_tid checks earlier in alloc_pid() (Christian)
> >  - remove unnecessary comment and struct size check (Christian)
> >
> > v6:
> >  - remove CLONE_SET_TID from description (Christian)
> >  - add clone3() tests for different clone_args sizes (Christian)
> >  - move more set_tid checks to alloc_pid() (Oleg)
> >  - make all set_tid checks lockless (Oleg)
> > ---
> >  include/linux/pid.h        |  2 +-
> >  include/linux/sched/task.h |  1 +
> >  include/uapi/linux/sched.h |  1 +
> >  kernel/fork.c              | 14 ++++++++++++--
> >  kernel/pid.c               | 37 ++++++++++++++++++++++++++++++-------
> >  5 files changed, 45 insertions(+), 10 deletions(-)
> >
> > diff --git a/include/linux/pid.h b/include/linux/pid.h
> > index 2a83e434db9d..052000db0ced 100644
> > --- a/include/linux/pid.h
> > +++ b/include/linux/pid.h
> > @@ -116,7 +116,7 @@ extern struct pid *find_vpid(int nr);
> >  extern struct pid *find_get_pid(int nr);
> >  extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
> >
> > -extern struct pid *alloc_pid(struct pid_namespace *ns);
> > +extern struct pid *alloc_pid(struct pid_namespace *ns, pid_t set_tid);
> >  extern void free_pid(struct pid *pid);
> >  extern void disable_pid_allocation(struct pid_namespace *ns);
> >
> > diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
> > index 0497091e40c1..4f2a80564332 100644
> > --- a/include/linux/sched/task.h
> > +++ b/include/linux/sched/task.h
> > @@ -26,6 +26,7 @@ struct kernel_clone_args {
> >         unsigned long stack;
> >         unsigned long stack_size;
> >         unsigned long tls;
> > +       pid_t set_tid;
> >  };
> >
> >  /*
> > diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
> > index b3105ac1381a..e1ce103a2c47 100644
> > --- a/include/uapi/linux/sched.h
> > +++ b/include/uapi/linux/sched.h
> > @@ -45,6 +45,7 @@ struct clone_args {
> >         __aligned_u64 stack;
> >         __aligned_u64 stack_size;
> >         __aligned_u64 tls;
> > +       __aligned_u64 set_tid;
> >  };
> >
> >  /*
> > diff --git a/kernel/fork.c b/kernel/fork.c
> > index 2852d0e76ea3..8317d408a8d6 100644
> > --- a/kernel/fork.c
> > +++ b/kernel/fork.c
> > @@ -117,6 +117,11 @@
> >   */
> >  #define MAX_THREADS FUTEX_TID_MASK
> >
> > +/*
> > + * For different sizes of struct clone_args
> > + */
> > +#define CLONE3_ARGS_SIZE_V0 64
> > +
> >  /*
> >   * Protected counters by write_lock_irq(&tasklist_lock)
> >   */
> > @@ -2031,7 +2036,7 @@ static __latent_entropy struct task_struct *copy_process(
> >         stackleak_task_init(p);
> >
> >         if (pid != &init_struct_pid) {
> > -               pid = alloc_pid(p->nsproxy->pid_ns_for_children);
> > +               pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid);
> >                 if (IS_ERR(pid)) {
> >                         retval = PTR_ERR(pid);
> >                         goto bad_fork_cleanup_thread;
> > @@ -2535,9 +2540,13 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
> >         if (unlikely(size > PAGE_SIZE))
> >                 return -E2BIG;
> >
> > -       if (unlikely(size < sizeof(struct clone_args)))
> > +       if (unlikely(size < CLONE3_ARGS_SIZE_V0))
> >                 return -EINVAL;
> >
> > +       if (size < sizeof(struct clone_args))
> > +               memset((void *)&args + size, 0,
> > +                               sizeof(struct clone_args) - size);
> > +
> >         if (unlikely(!access_ok(uargs, size)))
> >                 return -EFAULT;
> >
> > @@ -2571,6 +2580,7 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
> >                 .stack          = args.stack,
> >                 .stack_size     = args.stack_size,
> >                 .tls            = args.tls,
> > +               .set_tid        = args.set_tid,
> >         };
> >
> >         return 0;
> > diff --git a/kernel/pid.c b/kernel/pid.c
> > index 0a9f2e437217..5cdab73b9094 100644
> > --- a/kernel/pid.c
> > +++ b/kernel/pid.c
> > @@ -157,7 +157,7 @@ void free_pid(struct pid *pid)
> >         call_rcu(&pid->rcu, delayed_put_pid);
> >  }
> >
> > -struct pid *alloc_pid(struct pid_namespace *ns)
> > +struct pid *alloc_pid(struct pid_namespace *ns, int set_tid)
> >  {
> >         struct pid *pid;
> >         enum pid_type type;
> > @@ -166,6 +166,16 @@ struct pid *alloc_pid(struct pid_namespace *ns)
> >         struct upid *upid;
> >         int retval = -ENOMEM;
> >
> > +       if (set_tid) {
> > +               if (set_tid < 0 || set_tid >= pid_max)
> > +                       return ERR_PTR(-EINVAL);
> > +               /* Also fail if a PID != 1 is requested and no PID 1 exists */
> > +               if (set_tid != 1 && !ns->child_reaper)
> > +                       return ERR_PTR(-EINVAL);
> 
> What will happen if I will create a new pid namespace
> (unsahre(CLONE_NEWPID)) and then call clone3 with tid which isn't
> equal to 1?
> 
> Will I get the init process with the 5 pid?...

No, you will get -EINVAL. In the selftest exactly this is tested. A PID
1 is still required even with this patch.

> > +               if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> > +                       return ERR_PTR(-EPERM);
> > +       }
> > +
> >         pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
> >         if (!pid)
> >                 return ERR_PTR(retval);
> > @@ -186,12 +196,25 @@ struct pid *alloc_pid(struct pid_namespace *ns)
> >                 if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
> >                         pid_min = RESERVED_PIDS;
> >
> > -               /*
> > -                * Store a null pointer so find_pid_ns does not find
> > -                * a partially initialized PID (see below).
> > -                */
> > -               nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> > -                                     pid_max, GFP_ATOMIC);
> > +               if (set_tid) {
> > +                       nr = idr_alloc(&tmp->idr, NULL, set_tid,
> > +                                       set_tid + 1, GFP_ATOMIC);
> > +                       /*
> > +                        * If ENOSPC is returned it means that the PID is
> > +                        * alreay in use. Return EEXIST in that case.
> > +                        */
> > +                       if (nr == -ENOSPC)
> > +                               nr = -EEXIST;
> > +                       /* Only use set_tid for one PID namespace. */
> > +                       set_tid = 0;
> > +               } else {
> > +                       /*
> > +                        * Store a null pointer so find_pid_ns does not find
> > +                        * a partially initialized PID (see below).
> > +                        */
> > +                       nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> > +                                             pid_max, GFP_ATOMIC);
> > +               }
> >                 spin_unlock_irq(&pidmap_lock);
> >                 idr_preload_end();
> >
> > --
> > 2.21.0
> >

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Christian Brauner]

On Mon, Aug 12, 2019 at 11:02:41PM +0200, Adrian Reber wrote:
> On Mon, Aug 12, 2019 at 01:43:53PM -0700, Andrei Vagin wrote:
> > On Mon, Aug 12, 2019 at 1:10 PM Adrian Reber <areber@redhat.com> wrote:
> > >
> > > The main motivation to add set_tid to clone3() is CRIU.
> > >
> > > To restore a process with the same PID/TID CRIU currently uses
> > > /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> > > ns_last_pid and then (quickly) does a clone(). This works most of the
> > > time, but it is racy. It is also slow as it requires multiple syscalls.
> > >
> > > Extending clone3() to support set_tid makes it possible restore a
> > > process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> > > race free (as long as the desired PID/TID is available).
> > >
> > > This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> > > on clone3() with set_tid as they are currently in place for ns_last_pid.
> > >
> > > Signed-off-by: Adrian Reber <areber@redhat.com>
> > > ---
> > > v2:
> > >  - Removed (size < sizeof(struct clone_args)) as discussed with
> > >    Christian and Dmitry
> > >  - Added comment to ((set_tid != 1) && idr_get_cursor() <= 1) (Oleg)
> > >  - Use idr_alloc() instead of idr_alloc_cyclic() (Oleg)
> > >
> > > v3:
> > >  - Return EEXIST if PID is already in use (Christian)
> > >  - Drop CLONE_SET_TID (Christian and Oleg)
> > >  - Use idr_is_empty() instead of idr_get_cursor() (Oleg)
> > >  - Handle different `struct clone_args` sizes (Dmitry)
> > >
> > > v4:
> > >  - Rework struct size check with defines (Christian)
> > >  - Reduce number of set_tid checks (Oleg)
> > >  - Less parentheses and more robust code (Oleg)
> > >  - Do ns_capable() on correct user_ns (Oleg, Christian)
> > >
> > > v5:
> > >  - make set_tid checks earlier in alloc_pid() (Christian)
> > >  - remove unnecessary comment and struct size check (Christian)
> > >
> > > v6:
> > >  - remove CLONE_SET_TID from description (Christian)
> > >  - add clone3() tests for different clone_args sizes (Christian)
> > >  - move more set_tid checks to alloc_pid() (Oleg)
> > >  - make all set_tid checks lockless (Oleg)
> > > ---
> > >  include/linux/pid.h        |  2 +-
> > >  include/linux/sched/task.h |  1 +
> > >  include/uapi/linux/sched.h |  1 +
> > >  kernel/fork.c              | 14 ++++++++++++--
> > >  kernel/pid.c               | 37 ++++++++++++++++++++++++++++++-------
> > >  5 files changed, 45 insertions(+), 10 deletions(-)
> > >
> > > diff --git a/include/linux/pid.h b/include/linux/pid.h
> > > index 2a83e434db9d..052000db0ced 100644
> > > --- a/include/linux/pid.h
> > > +++ b/include/linux/pid.h
> > > @@ -116,7 +116,7 @@ extern struct pid *find_vpid(int nr);
> > >  extern struct pid *find_get_pid(int nr);
> > >  extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
> > >
> > > -extern struct pid *alloc_pid(struct pid_namespace *ns);
> > > +extern struct pid *alloc_pid(struct pid_namespace *ns, pid_t set_tid);
> > >  extern void free_pid(struct pid *pid);
> > >  extern void disable_pid_allocation(struct pid_namespace *ns);
> > >
> > > diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
> > > index 0497091e40c1..4f2a80564332 100644
> > > --- a/include/linux/sched/task.h
> > > +++ b/include/linux/sched/task.h
> > > @@ -26,6 +26,7 @@ struct kernel_clone_args {
> > >         unsigned long stack;
> > >         unsigned long stack_size;
> > >         unsigned long tls;
> > > +       pid_t set_tid;
> > >  };
> > >
> > >  /*
> > > diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
> > > index b3105ac1381a..e1ce103a2c47 100644
> > > --- a/include/uapi/linux/sched.h
> > > +++ b/include/uapi/linux/sched.h
> > > @@ -45,6 +45,7 @@ struct clone_args {
> > >         __aligned_u64 stack;
> > >         __aligned_u64 stack_size;
> > >         __aligned_u64 tls;
> > > +       __aligned_u64 set_tid;
> > >  };
> > >
> > >  /*
> > > diff --git a/kernel/fork.c b/kernel/fork.c
> > > index 2852d0e76ea3..8317d408a8d6 100644
> > > --- a/kernel/fork.c
> > > +++ b/kernel/fork.c
> > > @@ -117,6 +117,11 @@
> > >   */
> > >  #define MAX_THREADS FUTEX_TID_MASK
> > >
> > > +/*
> > > + * For different sizes of struct clone_args
> > > + */
> > > +#define CLONE3_ARGS_SIZE_V0 64
> > > +
> > >  /*
> > >   * Protected counters by write_lock_irq(&tasklist_lock)
> > >   */
> > > @@ -2031,7 +2036,7 @@ static __latent_entropy struct task_struct *copy_process(
> > >         stackleak_task_init(p);
> > >
> > >         if (pid != &init_struct_pid) {
> > > -               pid = alloc_pid(p->nsproxy->pid_ns_for_children);
> > > +               pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid);
> > >                 if (IS_ERR(pid)) {
> > >                         retval = PTR_ERR(pid);
> > >                         goto bad_fork_cleanup_thread;
> > > @@ -2535,9 +2540,13 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
> > >         if (unlikely(size > PAGE_SIZE))
> > >                 return -E2BIG;
> > >
> > > -       if (unlikely(size < sizeof(struct clone_args)))
> > > +       if (unlikely(size < CLONE3_ARGS_SIZE_V0))
> > >                 return -EINVAL;
> > >
> > > +       if (size < sizeof(struct clone_args))
> > > +               memset((void *)&args + size, 0,
> > > +                               sizeof(struct clone_args) - size);
> > > +
> > >         if (unlikely(!access_ok(uargs, size)))
> > >                 return -EFAULT;
> > >
> > > @@ -2571,6 +2580,7 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
> > >                 .stack          = args.stack,
> > >                 .stack_size     = args.stack_size,
> > >                 .tls            = args.tls,
> > > +               .set_tid        = args.set_tid,
> > >         };
> > >
> > >         return 0;
> > > diff --git a/kernel/pid.c b/kernel/pid.c
> > > index 0a9f2e437217..5cdab73b9094 100644
> > > --- a/kernel/pid.c
> > > +++ b/kernel/pid.c
> > > @@ -157,7 +157,7 @@ void free_pid(struct pid *pid)
> > >         call_rcu(&pid->rcu, delayed_put_pid);
> > >  }
> > >
> > > -struct pid *alloc_pid(struct pid_namespace *ns)
> > > +struct pid *alloc_pid(struct pid_namespace *ns, int set_tid)
> > >  {
> > >         struct pid *pid;
> > >         enum pid_type type;
> > > @@ -166,6 +166,16 @@ struct pid *alloc_pid(struct pid_namespace *ns)
> > >         struct upid *upid;
> > >         int retval = -ENOMEM;
> > >
> > > +       if (set_tid) {
> > > +               if (set_tid < 0 || set_tid >= pid_max)
> > > +                       return ERR_PTR(-EINVAL);
> > > +               /* Also fail if a PID != 1 is requested and no PID 1 exists */
> > > +               if (set_tid != 1 && !ns->child_reaper)
> > > +                       return ERR_PTR(-EINVAL);
> > 
> > What will happen if I will create a new pid namespace
> > (unsahre(CLONE_NEWPID)) and then call clone3 with tid which isn't
> > equal to 1?
> > 
> > Will I get the init process with the 5 pid?...
> 
> No, you will get -EINVAL. In the selftest exactly this is tested. A PID
> 1 is still required even with this patch.

Correct. unshare(CLONE_PIDNS) leaves ->child_reaper unset.
->child_reaper is set when pid 1 is created in the pid namespace. So you
that check catches the scenarios afaict. Adrians test should also have
caught that if it were possible. I hope he's running them. :)

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Andrei Vagin]

On Mon, Aug 12, 2019 at 2:03 PM Adrian Reber <areber@redhat.com> wrote:
>
> On Mon, Aug 12, 2019 at 01:43:53PM -0700, Andrei Vagin wrote:
> > On Mon, Aug 12, 2019 at 1:10 PM Adrian Reber <areber@redhat.com> wrote:
> > >
> > > The main motivation to add set_tid to clone3() is CRIU.
> > >
> > > To restore a process with the same PID/TID CRIU currently uses
> > > /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> > > ns_last_pid and then (quickly) does a clone(). This works most of the
> > > time, but it is racy. It is also slow as it requires multiple syscalls.
> > >
> > > Extending clone3() to support set_tid makes it possible restore a
> > > process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> > > race free (as long as the desired PID/TID is available).
> > >
> > > This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> > > on clone3() with set_tid as they are currently in place for ns_last_pid.
> > >
> > > Signed-off-by: Adrian Reber <areber@redhat.com>
> > > ---
> > > v2:
> > >  - Removed (size < sizeof(struct clone_args)) as discussed with
> > >    Christian and Dmitry
> > >  - Added comment to ((set_tid != 1) && idr_get_cursor() <= 1) (Oleg)
> > >  - Use idr_alloc() instead of idr_alloc_cyclic() (Oleg)
> > >
> > > v3:
> > >  - Return EEXIST if PID is already in use (Christian)
> > >  - Drop CLONE_SET_TID (Christian and Oleg)
> > >  - Use idr_is_empty() instead of idr_get_cursor() (Oleg)
> > >  - Handle different `struct clone_args` sizes (Dmitry)
> > >
> > > v4:
> > >  - Rework struct size check with defines (Christian)
> > >  - Reduce number of set_tid checks (Oleg)
> > >  - Less parentheses and more robust code (Oleg)
> > >  - Do ns_capable() on correct user_ns (Oleg, Christian)
> > >
> > > v5:
> > >  - make set_tid checks earlier in alloc_pid() (Christian)
> > >  - remove unnecessary comment and struct size check (Christian)
> > >
> > > v6:
> > >  - remove CLONE_SET_TID from description (Christian)
> > >  - add clone3() tests for different clone_args sizes (Christian)
> > >  - move more set_tid checks to alloc_pid() (Oleg)
> > >  - make all set_tid checks lockless (Oleg)
> > > ---
> > >  include/linux/pid.h        |  2 +-
> > >  include/linux/sched/task.h |  1 +
> > >  include/uapi/linux/sched.h |  1 +
> > >  kernel/fork.c              | 14 ++++++++++++--
> > >  kernel/pid.c               | 37 ++++++++++++++++++++++++++++++-------
> > >  5 files changed, 45 insertions(+), 10 deletions(-)
> > >
> > > diff --git a/include/linux/pid.h b/include/linux/pid.h
> > > index 2a83e434db9d..052000db0ced 100644
> > > --- a/include/linux/pid.h
> > > +++ b/include/linux/pid.h
> > > @@ -116,7 +116,7 @@ extern struct pid *find_vpid(int nr);
> > >  extern struct pid *find_get_pid(int nr);
> > >  extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
> > >
> > > -extern struct pid *alloc_pid(struct pid_namespace *ns);
> > > +extern struct pid *alloc_pid(struct pid_namespace *ns, pid_t set_tid);
> > >  extern void free_pid(struct pid *pid);
> > >  extern void disable_pid_allocation(struct pid_namespace *ns);
> > >
> > > diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
> > > index 0497091e40c1..4f2a80564332 100644
> > > --- a/include/linux/sched/task.h
> > > +++ b/include/linux/sched/task.h
> > > @@ -26,6 +26,7 @@ struct kernel_clone_args {
> > >         unsigned long stack;
> > >         unsigned long stack_size;
> > >         unsigned long tls;
> > > +       pid_t set_tid;
> > >  };
> > >
> > >  /*
> > > diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
> > > index b3105ac1381a..e1ce103a2c47 100644
> > > --- a/include/uapi/linux/sched.h
> > > +++ b/include/uapi/linux/sched.h
> > > @@ -45,6 +45,7 @@ struct clone_args {
> > >         __aligned_u64 stack;
> > >         __aligned_u64 stack_size;
> > >         __aligned_u64 tls;
> > > +       __aligned_u64 set_tid;
> > >  };
> > >
> > >  /*
> > > diff --git a/kernel/fork.c b/kernel/fork.c
> > > index 2852d0e76ea3..8317d408a8d6 100644
> > > --- a/kernel/fork.c
> > > +++ b/kernel/fork.c
> > > @@ -117,6 +117,11 @@
> > >   */
> > >  #define MAX_THREADS FUTEX_TID_MASK
> > >
> > > +/*
> > > + * For different sizes of struct clone_args
> > > + */
> > > +#define CLONE3_ARGS_SIZE_V0 64
> > > +
> > >  /*
> > >   * Protected counters by write_lock_irq(&tasklist_lock)
> > >   */
> > > @@ -2031,7 +2036,7 @@ static __latent_entropy struct task_struct *copy_process(
> > >         stackleak_task_init(p);
> > >
> > >         if (pid != &init_struct_pid) {
> > > -               pid = alloc_pid(p->nsproxy->pid_ns_for_children);
> > > +               pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid);
> > >                 if (IS_ERR(pid)) {
> > >                         retval = PTR_ERR(pid);
> > >                         goto bad_fork_cleanup_thread;
> > > @@ -2535,9 +2540,13 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
> > >         if (unlikely(size > PAGE_SIZE))
> > >                 return -E2BIG;
> > >
> > > -       if (unlikely(size < sizeof(struct clone_args)))
> > > +       if (unlikely(size < CLONE3_ARGS_SIZE_V0))
> > >                 return -EINVAL;
> > >
> > > +       if (size < sizeof(struct clone_args))
> > > +               memset((void *)&args + size, 0,
> > > +                               sizeof(struct clone_args) - size);
> > > +
> > >         if (unlikely(!access_ok(uargs, size)))
> > >                 return -EFAULT;
> > >
> > > @@ -2571,6 +2580,7 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
> > >                 .stack          = args.stack,
> > >                 .stack_size     = args.stack_size,
> > >                 .tls            = args.tls,
> > > +               .set_tid        = args.set_tid,
> > >         };
> > >
> > >         return 0;
> > > diff --git a/kernel/pid.c b/kernel/pid.c
> > > index 0a9f2e437217..5cdab73b9094 100644
> > > --- a/kernel/pid.c
> > > +++ b/kernel/pid.c
> > > @@ -157,7 +157,7 @@ void free_pid(struct pid *pid)
> > >         call_rcu(&pid->rcu, delayed_put_pid);
> > >  }
> > >
> > > -struct pid *alloc_pid(struct pid_namespace *ns)
> > > +struct pid *alloc_pid(struct pid_namespace *ns, int set_tid)
> > >  {
> > >         struct pid *pid;
> > >         enum pid_type type;
> > > @@ -166,6 +166,16 @@ struct pid *alloc_pid(struct pid_namespace *ns)
> > >         struct upid *upid;
> > >         int retval = -ENOMEM;
> > >
> > > +       if (set_tid) {
> > > +               if (set_tid < 0 || set_tid >= pid_max)
> > > +                       return ERR_PTR(-EINVAL);
> > > +               /* Also fail if a PID != 1 is requested and no PID 1 exists */
> > > +               if (set_tid != 1 && !ns->child_reaper)
> > > +                       return ERR_PTR(-EINVAL);
> >
> > What will happen if I will create a new pid namespace
> > (unsahre(CLONE_NEWPID)) and then call clone3 with tid which isn't
> > equal to 1?
> >
> > Will I get the init process with the 5 pid?...
>
> No, you will get -EINVAL. In the selftest exactly this is tested. A PID
> 1 is still required even with this patch.

Good. Thanks. I had to read the test.

>
> > > +               if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> > > +                       return ERR_PTR(-EPERM);
> > > +       }
> > > +
> > >         pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
> > >         if (!pid)
> > >                 return ERR_PTR(retval);
> > > @@ -186,12 +196,25 @@ struct pid *alloc_pid(struct pid_namespace *ns)
> > >                 if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
> > >                         pid_min = RESERVED_PIDS;
> > >
> > > -               /*
> > > -                * Store a null pointer so find_pid_ns does not find
> > > -                * a partially initialized PID (see below).
> > > -                */
> > > -               nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> > > -                                     pid_max, GFP_ATOMIC);
> > > +               if (set_tid) {
> > > +                       nr = idr_alloc(&tmp->idr, NULL, set_tid,
> > > +                                       set_tid + 1, GFP_ATOMIC);
> > > +                       /*
> > > +                        * If ENOSPC is returned it means that the PID is
> > > +                        * alreay in use. Return EEXIST in that case.
> > > +                        */
> > > +                       if (nr == -ENOSPC)
> > > +                               nr = -EEXIST;
> > > +                       /* Only use set_tid for one PID namespace. */
> > > +                       set_tid = 0;
> > > +               } else {
> > > +                       /*
> > > +                        * Store a null pointer so find_pid_ns does not find
> > > +                        * a partially initialized PID (see below).
> > > +                        */
> > > +                       nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> > > +                                             pid_max, GFP_ATOMIC);
> > > +               }
> > >                 spin_unlock_irq(&pidmap_lock);
> > >                 idr_preload_end();
> > >
> > > --
> > > 2.21.0
> > >

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Christian Brauner]

On Mon, Aug 12, 2019 at 10:09:38PM +0200, Adrian Reber wrote:
> The main motivation to add set_tid to clone3() is CRIU.
> 
> To restore a process with the same PID/TID CRIU currently uses
> /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> ns_last_pid and then (quickly) does a clone(). This works most of the
> time, but it is racy. It is also slow as it requires multiple syscalls.
> 
> Extending clone3() to support set_tid makes it possible restore a
> process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> race free (as long as the desired PID/TID is available).
> 
> This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> on clone3() with set_tid as they are currently in place for ns_last_pid.
> 
> Signed-off-by: Adrian Reber <areber@redhat.com>

I'm fine with this version. Oleg, how do you feel about it now? :)

Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

> ---
> v2:
>  - Removed (size < sizeof(struct clone_args)) as discussed with
>    Christian and Dmitry
>  - Added comment to ((set_tid != 1) && idr_get_cursor() <= 1) (Oleg)
>  - Use idr_alloc() instead of idr_alloc_cyclic() (Oleg)
> 
> v3:
>  - Return EEXIST if PID is already in use (Christian)
>  - Drop CLONE_SET_TID (Christian and Oleg)
>  - Use idr_is_empty() instead of idr_get_cursor() (Oleg)
>  - Handle different `struct clone_args` sizes (Dmitry)
> 
> v4:
>  - Rework struct size check with defines (Christian)
>  - Reduce number of set_tid checks (Oleg)
>  - Less parentheses and more robust code (Oleg)
>  - Do ns_capable() on correct user_ns (Oleg, Christian)
> 
> v5:
>  - make set_tid checks earlier in alloc_pid() (Christian)
>  - remove unnecessary comment and struct size check (Christian)
> 
> v6:
>  - remove CLONE_SET_TID from description (Christian)
>  - add clone3() tests for different clone_args sizes (Christian)
>  - move more set_tid checks to alloc_pid() (Oleg)
>  - make all set_tid checks lockless (Oleg)
> ---
>  include/linux/pid.h        |  2 +-
>  include/linux/sched/task.h |  1 +
>  include/uapi/linux/sched.h |  1 +
>  kernel/fork.c              | 14 ++++++++++++--
>  kernel/pid.c               | 37 ++++++++++++++++++++++++++++++-------
>  5 files changed, 45 insertions(+), 10 deletions(-)
> 
> diff --git a/include/linux/pid.h b/include/linux/pid.h
> index 2a83e434db9d..052000db0ced 100644
> --- a/include/linux/pid.h
> +++ b/include/linux/pid.h
> @@ -116,7 +116,7 @@ extern struct pid *find_vpid(int nr);
>  extern struct pid *find_get_pid(int nr);
>  extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
>  
> -extern struct pid *alloc_pid(struct pid_namespace *ns);
> +extern struct pid *alloc_pid(struct pid_namespace *ns, pid_t set_tid);
>  extern void free_pid(struct pid *pid);
>  extern void disable_pid_allocation(struct pid_namespace *ns);
>  
> diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
> index 0497091e40c1..4f2a80564332 100644
> --- a/include/linux/sched/task.h
> +++ b/include/linux/sched/task.h
> @@ -26,6 +26,7 @@ struct kernel_clone_args {
>  	unsigned long stack;
>  	unsigned long stack_size;
>  	unsigned long tls;
> +	pid_t set_tid;
>  };
>  
>  /*
> diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
> index b3105ac1381a..e1ce103a2c47 100644
> --- a/include/uapi/linux/sched.h
> +++ b/include/uapi/linux/sched.h
> @@ -45,6 +45,7 @@ struct clone_args {
>  	__aligned_u64 stack;
>  	__aligned_u64 stack_size;
>  	__aligned_u64 tls;
> +	__aligned_u64 set_tid;
>  };
>  
>  /*
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 2852d0e76ea3..8317d408a8d6 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -117,6 +117,11 @@
>   */
>  #define MAX_THREADS FUTEX_TID_MASK
>  
> +/*
> + * For different sizes of struct clone_args
> + */
> +#define CLONE3_ARGS_SIZE_V0 64
> +
>  /*
>   * Protected counters by write_lock_irq(&tasklist_lock)
>   */
> @@ -2031,7 +2036,7 @@ static __latent_entropy struct task_struct *copy_process(
>  	stackleak_task_init(p);
>  
>  	if (pid != &init_struct_pid) {
> -		pid = alloc_pid(p->nsproxy->pid_ns_for_children);
> +		pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid);
>  		if (IS_ERR(pid)) {
>  			retval = PTR_ERR(pid);
>  			goto bad_fork_cleanup_thread;
> @@ -2535,9 +2540,13 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
>  	if (unlikely(size > PAGE_SIZE))
>  		return -E2BIG;
>  
> -	if (unlikely(size < sizeof(struct clone_args)))
> +	if (unlikely(size < CLONE3_ARGS_SIZE_V0))
>  		return -EINVAL;
>  
> +	if (size < sizeof(struct clone_args))
> +		memset((void *)&args + size, 0,
> +				sizeof(struct clone_args) - size);
> +
>  	if (unlikely(!access_ok(uargs, size)))
>  		return -EFAULT;
>  
> @@ -2571,6 +2580,7 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
>  		.stack		= args.stack,
>  		.stack_size	= args.stack_size,
>  		.tls		= args.tls,
> +		.set_tid	= args.set_tid,
>  	};
>  
>  	return 0;
> diff --git a/kernel/pid.c b/kernel/pid.c
> index 0a9f2e437217..5cdab73b9094 100644
> --- a/kernel/pid.c
> +++ b/kernel/pid.c
> @@ -157,7 +157,7 @@ void free_pid(struct pid *pid)
>  	call_rcu(&pid->rcu, delayed_put_pid);
>  }
>  
> -struct pid *alloc_pid(struct pid_namespace *ns)
> +struct pid *alloc_pid(struct pid_namespace *ns, int set_tid)
>  {
>  	struct pid *pid;
>  	enum pid_type type;
> @@ -166,6 +166,16 @@ struct pid *alloc_pid(struct pid_namespace *ns)
>  	struct upid *upid;
>  	int retval = -ENOMEM;
>  
> +	if (set_tid) {
> +		if (set_tid < 0 || set_tid >= pid_max)
> +			return ERR_PTR(-EINVAL);
> +		/* Also fail if a PID != 1 is requested and no PID 1 exists */
> +		if (set_tid != 1 && !ns->child_reaper)
> +			return ERR_PTR(-EINVAL);
> +		if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> +			return ERR_PTR(-EPERM);
> +	}
> +
>  	pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
>  	if (!pid)
>  		return ERR_PTR(retval);
> @@ -186,12 +196,25 @@ struct pid *alloc_pid(struct pid_namespace *ns)
>  		if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
>  			pid_min = RESERVED_PIDS;
>  
> -		/*
> -		 * Store a null pointer so find_pid_ns does not find
> -		 * a partially initialized PID (see below).
> -		 */
> -		nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> -				      pid_max, GFP_ATOMIC);
> +		if (set_tid) {
> +			nr = idr_alloc(&tmp->idr, NULL, set_tid,
> +					set_tid + 1, GFP_ATOMIC);
> +			/*
> +			 * If ENOSPC is returned it means that the PID is
> +			 * alreay in use. Return EEXIST in that case.
> +			 */
> +			if (nr == -ENOSPC)
> +				nr = -EEXIST;
> +			/* Only use set_tid for one PID namespace. */
> +			set_tid = 0;
> +		} else {
> +			/*
> +			 * Store a null pointer so find_pid_ns does not find
> +			 * a partially initialized PID (see below).
> +			 */
> +			nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> +					      pid_max, GFP_ATOMIC);
> +		}
>  		spin_unlock_irq(&pidmap_lock);
>  		idr_preload_end();
>  
> -- 
> 2.21.0
> 

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Oleg Nesterov]

On 08/12, Adrian Reber wrote:
>
> The main motivation to add set_tid to clone3() is CRIU.
>
> To restore a process with the same PID/TID CRIU currently uses
> /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> ns_last_pid and then (quickly) does a clone(). This works most of the
> time, but it is racy. It is also slow as it requires multiple syscalls.
>
> Extending clone3() to support set_tid makes it possible restore a
> process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> race free (as long as the desired PID/TID is available).
>
> This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> on clone3() with set_tid as they are currently in place for ns_last_pid.
>
> Signed-off-by: Adrian Reber <areber@redhat.com>

Reviewed-by: Oleg Nesterov <oleg@redhat.com>

Re: [PATCH v6 2/2] selftests: add tests for clone3()

[Christian Brauner]

On Mon, Aug 12, 2019 at 10:09:39PM +0200, Adrian Reber wrote:
> This tests clone3() with and without set_tid to see if all desired PIDs
> are working as expected. The test tries to clone3() with a set_tid of
> -1, 1, pid_max, a PID which is already in use and an unused PID. The
> same tests are also running in PID namespace.
> 
> In addition the clone3 test (without set_tid) tries to call clone3()
> with different sizes of clone_args.
> 
> Signed-off-by: Adrian Reber <areber@redhat.com>

This is missing a .gitignore file for the new binaries. But no need to
resend I'll just add that myself.

Re: [PATCH v6 2/2] selftests: add tests for clone3()

[Christian Brauner]

On Tue, Aug 13, 2019 at 04:46:18PM +0200, Christian Brauner wrote:
> On Mon, Aug 12, 2019 at 10:09:39PM +0200, Adrian Reber wrote:
> > This tests clone3() with and without set_tid to see if all desired PIDs
> > are working as expected. The test tries to clone3() with a set_tid of
> > -1, 1, pid_max, a PID which is already in use and an unused PID. The
> > same tests are also running in PID namespace.
> > 
> > In addition the clone3 test (without set_tid) tries to call clone3()
> > with different sizes of clone_args.
> > 
> > Signed-off-by: Adrian Reber <areber@redhat.com>
> 
> This is missing a .gitignore file for the new binaries. But no need to
> resend I'll just add that myself.

Oh, I see it now. :)

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Pavel Emelianov]

On 8/12/19 11:09 PM, Adrian Reber wrote:
> The main motivation to add set_tid to clone3() is CRIU.
> 
> To restore a process with the same PID/TID CRIU currently uses
> /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> ns_last_pid and then (quickly) does a clone(). This works most of the
> time, but it is racy. It is also slow as it requires multiple syscalls.
> 
> Extending clone3() to support set_tid makes it possible restore a
> process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> race free (as long as the desired PID/TID is available).
> 
> This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> on clone3() with set_tid as they are currently in place for ns_last_pid.
> 
> Signed-off-by: Adrian Reber <areber@redhat.com>

Acked-by: Pavel Emelyanov <xemul@openvz.org>

> ---
> v2:
>  - Removed (size < sizeof(struct clone_args)) as discussed with
>    Christian and Dmitry
>  - Added comment to ((set_tid != 1) && idr_get_cursor() <= 1) (Oleg)
>  - Use idr_alloc() instead of idr_alloc_cyclic() (Oleg)
> 
> v3:
>  - Return EEXIST if PID is already in use (Christian)
>  - Drop CLONE_SET_TID (Christian and Oleg)
>  - Use idr_is_empty() instead of idr_get_cursor() (Oleg)
>  - Handle different `struct clone_args` sizes (Dmitry)
> 
> v4:
>  - Rework struct size check with defines (Christian)
>  - Reduce number of set_tid checks (Oleg)
>  - Less parentheses and more robust code (Oleg)
>  - Do ns_capable() on correct user_ns (Oleg, Christian)
> 
> v5:
>  - make set_tid checks earlier in alloc_pid() (Christian)
>  - remove unnecessary comment and struct size check (Christian)
> 
> v6:
>  - remove CLONE_SET_TID from description (Christian)
>  - add clone3() tests for different clone_args sizes (Christian)
>  - move more set_tid checks to alloc_pid() (Oleg)
>  - make all set_tid checks lockless (Oleg)
> ---
>  include/linux/pid.h        |  2 +-
>  include/linux/sched/task.h |  1 +
>  include/uapi/linux/sched.h |  1 +
>  kernel/fork.c              | 14 ++++++++++++--
>  kernel/pid.c               | 37 ++++++++++++++++++++++++++++++-------
>  5 files changed, 45 insertions(+), 10 deletions(-)
> 
> diff --git a/include/linux/pid.h b/include/linux/pid.h
> index 2a83e434db9d..052000db0ced 100644
> --- a/include/linux/pid.h
> +++ b/include/linux/pid.h
> @@ -116,7 +116,7 @@ extern struct pid *find_vpid(int nr);
>  extern struct pid *find_get_pid(int nr);
>  extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
>  
> -extern struct pid *alloc_pid(struct pid_namespace *ns);
> +extern struct pid *alloc_pid(struct pid_namespace *ns, pid_t set_tid);
>  extern void free_pid(struct pid *pid);
>  extern void disable_pid_allocation(struct pid_namespace *ns);
>  
> diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
> index 0497091e40c1..4f2a80564332 100644
> --- a/include/linux/sched/task.h
> +++ b/include/linux/sched/task.h
> @@ -26,6 +26,7 @@ struct kernel_clone_args {
>  	unsigned long stack;
>  	unsigned long stack_size;
>  	unsigned long tls;
> +	pid_t set_tid;
>  };
>  
>  /*
> diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
> index b3105ac1381a..e1ce103a2c47 100644
> --- a/include/uapi/linux/sched.h
> +++ b/include/uapi/linux/sched.h
> @@ -45,6 +45,7 @@ struct clone_args {
>  	__aligned_u64 stack;
>  	__aligned_u64 stack_size;
>  	__aligned_u64 tls;
> +	__aligned_u64 set_tid;
>  };
>  
>  /*
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 2852d0e76ea3..8317d408a8d6 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -117,6 +117,11 @@
>   */
>  #define MAX_THREADS FUTEX_TID_MASK
>  
> +/*
> + * For different sizes of struct clone_args
> + */
> +#define CLONE3_ARGS_SIZE_V0 64
> +
>  /*
>   * Protected counters by write_lock_irq(&tasklist_lock)
>   */
> @@ -2031,7 +2036,7 @@ static __latent_entropy struct task_struct *copy_process(
>  	stackleak_task_init(p);
>  
>  	if (pid != &init_struct_pid) {
> -		pid = alloc_pid(p->nsproxy->pid_ns_for_children);
> +		pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid);
>  		if (IS_ERR(pid)) {
>  			retval = PTR_ERR(pid);
>  			goto bad_fork_cleanup_thread;
> @@ -2535,9 +2540,13 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
>  	if (unlikely(size > PAGE_SIZE))
>  		return -E2BIG;
>  
> -	if (unlikely(size < sizeof(struct clone_args)))
> +	if (unlikely(size < CLONE3_ARGS_SIZE_V0))
>  		return -EINVAL;
>  
> +	if (size < sizeof(struct clone_args))
> +		memset((void *)&args + size, 0,
> +				sizeof(struct clone_args) - size);
> +
>  	if (unlikely(!access_ok(uargs, size)))
>  		return -EFAULT;
>  
> @@ -2571,6 +2580,7 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
>  		.stack		= args.stack,
>  		.stack_size	= args.stack_size,
>  		.tls		= args.tls,
> +		.set_tid	= args.set_tid,
>  	};
>  
>  	return 0;
> diff --git a/kernel/pid.c b/kernel/pid.c
> index 0a9f2e437217..5cdab73b9094 100644
> --- a/kernel/pid.c
> +++ b/kernel/pid.c
> @@ -157,7 +157,7 @@ void free_pid(struct pid *pid)
>  	call_rcu(&pid->rcu, delayed_put_pid);
>  }
>  
> -struct pid *alloc_pid(struct pid_namespace *ns)
> +struct pid *alloc_pid(struct pid_namespace *ns, int set_tid)
>  {
>  	struct pid *pid;
>  	enum pid_type type;
> @@ -166,6 +166,16 @@ struct pid *alloc_pid(struct pid_namespace *ns)
>  	struct upid *upid;
>  	int retval = -ENOMEM;
>  
> +	if (set_tid) {
> +		if (set_tid < 0 || set_tid >= pid_max)
> +			return ERR_PTR(-EINVAL);
> +		/* Also fail if a PID != 1 is requested and no PID 1 exists */
> +		if (set_tid != 1 && !ns->child_reaper)
> +			return ERR_PTR(-EINVAL);
> +		if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
> +			return ERR_PTR(-EPERM);
> +	}
> +
>  	pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
>  	if (!pid)
>  		return ERR_PTR(retval);
> @@ -186,12 +196,25 @@ struct pid *alloc_pid(struct pid_namespace *ns)
>  		if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
>  			pid_min = RESERVED_PIDS;
>  
> -		/*
> -		 * Store a null pointer so find_pid_ns does not find
> -		 * a partially initialized PID (see below).
> -		 */
> -		nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> -				      pid_max, GFP_ATOMIC);
> +		if (set_tid) {
> +			nr = idr_alloc(&tmp->idr, NULL, set_tid,
> +					set_tid + 1, GFP_ATOMIC);
> +			/*
> +			 * If ENOSPC is returned it means that the PID is
> +			 * alreay in use. Return EEXIST in that case.
> +			 */
> +			if (nr == -ENOSPC)
> +				nr = -EEXIST;
> +			/* Only use set_tid for one PID namespace. */
> +			set_tid = 0;
> +		} else {
> +			/*
> +			 * Store a null pointer so find_pid_ns does not find
> +			 * a partially initialized PID (see below).
> +			 */
> +			nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
> +					      pid_max, GFP_ATOMIC);
> +		}
>  		spin_unlock_irq(&pidmap_lock);
>  		idr_preload_end();
>  
> 

Re: [PATCH v6 1/2] fork: extend clone3() to support setting a PID

[Christian Brauner]

On Wed, Aug 14, 2019 at 09:50:03AM +0000, Pavel Emelianov wrote:
> On 8/12/19 11:09 PM, Adrian Reber wrote:
> > The main motivation to add set_tid to clone3() is CRIU.
> > 
> > To restore a process with the same PID/TID CRIU currently uses
> > /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> > ns_last_pid and then (quickly) does a clone(). This works most of the
> > time, but it is racy. It is also slow as it requires multiple syscalls.
> > 
> > Extending clone3() to support set_tid makes it possible restore a
> > process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> > race free (as long as the desired PID/TID is available).
> > 
> > This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> > on clone3() with set_tid as they are currently in place for ns_last_pid.
> > 
> > Signed-off-by: Adrian Reber <areber@redhat.com>
> 
> Acked-by: Pavel Emelyanov <xemul@openvz.org>

On Tue, Aug 13, 2019 at 04:30:24PM +0200, Oleg Nesterov wrote:
> On 08/12, Adrian Reber wrote:
> >
> > The main motivation to add set_tid to clone3() is CRIU.
> >
> > To restore a process with the same PID/TID CRIU currently uses
> > /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> > ns_last_pid and then (quickly) does a clone(). This works most of the
> > time, but it is racy. It is also slow as it requires multiple syscalls.
> >
> > Extending clone3() to support set_tid makes it possible restore a
> > process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> > race free (as long as the desired PID/TID is available).
> >
> > This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> > on clone3() with set_tid as they are currently in place for ns_last_pid.
> >
> > Signed-off-by: Adrian Reber <areber@redhat.com>
> 
> Reviewed-by: Oleg Nesterov <oleg@redhat.com>
> 

Added-to:
https://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux.git/log/?h=pidfd

Merged-into:
https://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux.git/log/?h=for-next

Thanks!
Christian