linux-kernel - Re: 2.6.23-mm1 thread exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071013114820.GA121@tv-sign.ru>
Date:	Sat, 13 Oct 2007 15:48:20 +0400
From:	Oleg Nesterov <oleg@...sign.ru>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>,
	viro@....linux.org.uk, kamezawa.hiroyu@...fujitsu.com,
	linux-kernel@...r.kernel.org, sam@...nborg.org,
	netdev@...r.kernel.org, Pavel Emelyanov <xemul@...nvz.org>,
	Sukadev Bhattiprolu <sukadev@...ibm.com>,
	Paul Menage <menage@...gle.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: 2.6.23-mm1 thread exit_group issue

On 10/12, Andrew Morton wrote:
>
> On Fri, 12 Oct 2007 15:47:59 -0400
> Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca> wrote:
> 
> > Hi Andrew,
> > 
> > I noticed a regression between 2.6.23-rc8-mm2 and 2.6.23-mm1 (with your
> > hotfixes). User space threads seems to receive a ERESTART_RESTARTBLOCK
> > as soon as a thread does a pthread_join on them. The previous behavior
> > was to wait for them to exit by taking a futex.

No, the reason is that pthread_join() succeeds while it shouldn't. The main
thread does exit_group() and kills the sub-thread sleeping in nanosleep.
ERESTART_RESTARTBLOCK is not delivered to the user-space (sub-thread is dying),
it is just reported by gdb.

> > I provide a toy program that shows the problem. On 2.6.23-rc8-mm2, it
> > loops forever (as it should). On 2.6.23-mm1, it exits after 10 seconds.

I bet something like this

	void *threda(void *arg)
	{
		for (;;)
			pause();
		return NULL;
	}

	int main(void)
	{
		pthread_t tid;

		pthread_create(&tid, NULL, thread, NULL);
		pthread_join(tid, NULL);

		return 0;
	}

won't work as well.

> > Any idea on what may cause this problem ?

Because do_fork() doesn't use parent_tidptr. At all! So it is very clear
why 2.6.23-mm1 is broken.

> Bisection shows that this problem is caused by these two patches:
>
> pid-namespaces-allow-cloning-of-new-namespace.patch

This? http://marc.info/?l=linux-mm-commits&m=118712242002039

Pavel, this patch has a subtle difference compared to what we discussed on
containers list. It moves put_user(parent_tidptr) from copy_process() to
do_fork(), so we don't report child's pid if copy_process() failed. I do
not think this is bad, but Eric seems to disagree with such a change.

But I can't understand why Andrew sees the same problem _after_ this patch!

And which patch removed the "put_user(nr, parent_tidptr)" chunk?

Andrew, could I get the kernel source after bisection somehow? (I am not
familiar with guilt, will try to study it later)

Mathieu, could you try the patch below?

Oleg.

--- kernel/fork.c~	2007-10-13 15:41:35.000000000 +0400
+++ kernel/fork.c	2007-10-13 15:41:41.000000000 +0400
@@ -1443,6 +1443,9 @@ long do_fork(unsigned long clone_flags,
 			task_pid_nr_ns(p, current->nsproxy->pid_ns) :
 				task_pid_vnr(p);

+		if (clone_flags & CLONE_PARENT_SETTID)
+			put_user(nr, parent_tidptr);
+
 		if (clone_flags & CLONE_VFORK) {
 			p->vfork_done = &vfork;
 			init_completion(&vfork);

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/