From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF444C282DD for ; Thu, 23 May 2019 21:00:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7A24D2186A for ; Thu, 23 May 2019 21:00:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731621AbfEWVAv (ORCPT ); Thu, 23 May 2019 17:00:51 -0400 Received: from out02.mta.xmission.com ([166.70.13.232]:41938 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726222AbfEWVAv (ORCPT ); Thu, 23 May 2019 17:00:51 -0400 Received: from in01.mta.xmission.com ([166.70.13.51]) by out02.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1hTupV-0007qQ-ML; Thu, 23 May 2019 15:00:49 -0600 Received: from ip72-206-97-68.om.om.cox.net ([72.206.97.68] helo=x220.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1hTupU-0000D6-Kg; Thu, 23 May 2019 15:00:49 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Dave P Martin Cc: "linux-kernel\@vger.kernel.org" , Linux Containers , Oleg Nesterov , "linux-arch\@vger.kernel.org" , James Morse , Will Deacon References: <20190523003916.20726-1-ebiederm@xmission.com> <20190523003916.20726-4-ebiederm@xmission.com> <20190523102101.GW28398@e103592.cambridge.arm.com> <87r28pgr3h.fsf@xmission.com> <20190523161256.GF2019@e103592.cambridge.arm.com> Date: Thu, 23 May 2019 16:00:41 -0500 In-Reply-To: <20190523161256.GF2019@e103592.cambridge.arm.com> (Dave P. Martin's message of "Thu, 23 May 2019 16:12:59 +0000") Message-ID: <87woigdgxy.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1hTupU-0000D6-Kg;;;mid=<87woigdgxy.fsf@xmission.com>;;;hst=in01.mta.xmission.com;;;ip=72.206.97.68;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/caa7T4Y9Jn68CDlq5knTS/PKpHJdEd74= X-SA-Exim-Connect-IP: 72.206.97.68 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [REVIEW][PATCH 03/26] signal/arm64: Use force_sig not force_sig_fault for SIGKILL X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Dave P Martin writes: > On Thu, May 23, 2019 at 03:53:06PM +0100, Eric W. Biederman wrote: >> Dave Martin writes: >> >> > On Thu, May 23, 2019 at 01:38:53AM +0100, Eric W. Biederman wrote: >> >> It really only matters to debuggers but the SIGKILL does not have any >> >> si_codes that use the fault member of the siginfo union. Correct this >> >> the simple way and call force_sig instead of force_sig_fault when the >> >> signal is SIGKILL. >> > >> > I haven't fully understood the context for this, but why does it matter >> > what's in siginfo for SIGKILL? My understanding is that userspace >> > (including ptrace) never gets to see it anyway for the SIGKILL case. >> >> Yes. In practice I think it would take tracing or something very >> exotic to notice anything going wrong because the task will be killed. >> >> > Here it feels like SIGKILL is logically a synchronous, thread-targeted >> > fault: we must ensure that no subsequent insn in current executes (just >> > like other fault signal). In this case, I thought we fall back to >> > SIGKILL not because there is no fault, but because we failed to >> > properly diagnose or report the type of fault that occurred. >> > >> > So maybe handling it consistently with other faults signals makes >> > sense. The fact that delivery of this signal destroys the process >> > before anyone can look at the resulting siginfo feels like a >> > side-effect rather than something obviously wrong. >> > >> > The siginfo is potentially useful diagnostic information, that we could >> > subsequently provide a means to access post-mortem. >> > >> > I just dived in on this single patch, so I may be missing something more >> > fundamental, or just being pedantic... >> >> Not really. I was working on another cleanup and this usage of SIGKILL >> came up. >> >> A synchronous thread synchronous fault gets us as far as the forc_sig >> family of functions. That only leaves the question of which union >> member in struct siginfo we are using. The union members are _kill, >> _fault, _timer, _rt, _sigchld, _sigfault, _sigpoll, and _sigsys. >> >> As it has prove quite error prone for people to fill out struct siginfo >> in the past by hand, I have provided a couple of helper functions for >> the common cases that come up such as: force_sig_fault, >> force_sig_mceerr, force_sig_bnderr, force_sig_pkuerr. Each of those >> helper functions takes the information needed to fill out the union >> member of struct siginfo that kind of fault corresponds to. >> >> For the SIGKILL case the only si_code I see being passed SI_KERNEL. >> The SI_KERNEL si_code corresponds to the _kill union member while >> force_sig_fault fills in fields for the _fault union member. >> >> Because of the mismatch of which union member SIGKILL should be using >> and the union member force_sig_fault applies alarm bells ring in my head >> when I read the current arm64 kernel code. Somewhat doubly so because >> the other fields in passed to force_sig_fault appear to be somewhat >> random when SIGKILL is the signal. >> >> So I figured let's preserve the usage of SIGKILL as a synchronous >> exception. That seems legitimate and other folks do that as well but >> let's use force_sig instead of force_sig_fault instead. I don't know if >> userspace will notice but at the very least we won't be providing a bad >> example for other kernel code to follow and we won't wind up be making >> assumptions that are true today and false tomorrow when some >> implementation detail changes. >> >> For imformation on what signals and si_codes correspond to which >> union members you can look at siginfo_layout. That function >> is the keeper of the magic decoder key. Currently the only two >> si_codes defined for SIGKILL are SI_KERNEL and SI_USER both of which >> correspond to a _kill union member. > > I see. Assuming we cannot have a dummy internal si_code for this > special case (probably a bad idea), I think Will's suggestion of at > least pushing the special case handling down into > arm64_force_sig_fault() is probably a bit cleaner here, expecially > if other callers of that function may pass in SIGKILL (I haven't > looked though). Done in my v2 version of this patch. Eric