[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <45ECEF85.2080503@google.com>
Date: Mon, 05 Mar 2007 20:35:17 -0800
From: Mathieu Desnoyers <compudj@...gle.com>
To: Andi Kleen <ak@...e.de>
CC: Andrew Morton <akpm@...ux-foundation.org>,
"Martin J. Bligh" <mbligh@...gle.com>,
linux-kernel@...r.kernel.org,
"David S. Miller" <davem@...emloft.net>,
Paul Mackerras <paulus@...ba.org>,
"Luck, Tony" <tony.luck@...el.com>,
Haavard Skinnemoen <hskinnemoen@...el.com>
Subject: Re: Thread flags modified without set_thread_flag() (non atomically)
Andi Kleen wrote:
>> It does seem risky. Perhaps it is a micro-optimisation which utilises
>> knowledge that this thread_struct cannot be looked up via any path in this
>> context.
>>
>> Or perhaps it is a bug. Andi, can you please comment?
>>
>
> On flush_thread nobody else can mess with the thread, so yes it's a micro
> optimization.
>
>
Hi Andi,
Here is what I think would be a counter example :
If, at the same time, we have, on x86_64 :
parent process executing :
sys_ptrace()
(lock_kernel())
(ptrace_get_task_struct(pid))
arch_ptrace()
ptrace_detach()
ptrace_disable(child);
clear_singlestep(child);
clear_tsk_thread_flag(child, TIF_SINGLESTEP);
(which clears the TIF_SINGLESTEP flag atomically from a
different process)
(put_task_struct(child))
(unlock_kernel())
And at the same time, in the child process :
sys_execve()
do_execve()
search_binary_handler()
load_elf_binary()
flush_old_exec()
flush_thread()
doing a non-atomic thread flag update
Is there any protection mechanism that would protect from this race
condition
that I have missed ?
>>> And about this specific flush_thread, I am puzzled about the t->flags ^=
>>> (_TIF_ABI_PENDING | _TIF_IA32); line. The XOR will clearly flip the
>>> _TIF_ABI_PENDING bit to 0, and very likely set _TIF_IA32 to the opposite
>>> of its current value. Why does this change need to be written atomically
>>> (can other threads play with these flags ?) ?
>>>
>>>
>> Don't know.
>>
>
> iirc it came from DaveM originally. He just likes to write things in
> comp^wclever ways :0) It's just a little shorter.
>
>
>> No, I don't immediately see anything in the flush_old_exec() code path
>> which tells us that nobody else can look up this thread_info (or be holding
>> a ref to it) in this context.
>>
>
> Normally the process flags atomicity should only matter with signals;
> i don't think you can send a signal to a process being in exec this way.
>
> -Andi
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists