linux-kernel - Re: [PATCH] account_group_exec_runtime: fix the racy usage of ->signal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081107162101.GA2178@elte.hu>
Date:	Fri, 7 Nov 2008 17:21:01 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>, adobriyan@...il.com,
	Doug Chapman <doug.chapman@...com>,
	Peter Zijlstra <peterz@...radead.org>,
	Roland McGrath <roland@...hat.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] account_group_exec_runtime: fix the racy usage of
	->signal


* Oleg Nesterov <oleg@...hat.com> wrote:

> Compile tested.
> 
> Unlike other similar routines, account_group_exec_runtime() could be
> called "implicitly" after exit_notify(). This means we can race with
> the parent doing release_task(), we can't just check ->signal != NULL.
> 
> Take ->siglock to make sure ->signal can't go away.
> 
> This is the minimal fix, with this patch we don't need need get/put cpu,
> and I think we should uninline this function.
> 
> Signed-off-by: Oleg Nesterov <oleg@...hat.com>

> 
> --- K-28/kernel/sched_stats.h~A_G_E_R_FIX	2008-11-07 17:32:02.000000000 +0100
> +++ K-28/kernel/sched_stats.h	2008-11-07 17:44:39.000000000 +0100
> @@ -351,10 +351,12 @@ static inline void account_group_exec_ru
>  					      unsigned long long ns)
>  {
>  	struct signal_struct *sig;
> +	unsigned long flags;
>  
> -	sig = tsk->signal;
> -	if (unlikely(!sig))
> +	if (unlikely(!lock_task_sighand(tsk, &flags)))
>  		return;

i think this will lock up: the signal lock must not nest inside the rq 
lock, and these accounting functions are called from within the 
scheduler.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/