linux-kernel - Re: [PATCH] sched: fix another race when reading /proc/sched

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <494370C0.4050005@cn.fujitsu.com>
Date:	Sat, 13 Dec 2008 16:22:24 +0800
From:	Li Zefan <lizf@...fujitsu.com>
To:	Bharata B Rao <bharata.rao@...il.com>
CC:	Ingo Molnar <mingo@...e.hu>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Paul Menage <menage@...gle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] sched: fix another race when reading /proc/sched_debug

Bharata B Rao wrote:
> On Fri, Dec 12, 2008 at 3:23 PM, Li Zefan <lizf@...fujitsu.com> wrote:
>>  kernel/sched_debug.c |   10 ++++++++--
>>  1 files changed, 8 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
>> index 26ed8e3..01abf5b 100644
>> --- a/kernel/sched_debug.c
>> +++ b/kernel/sched_debug.c
>> @@ -127,8 +127,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
>>        if (tg)
>>                cgroup = tg->css.cgroup;
>>
>> -       if (cgroup)
>> +       if (cgroup) {
>> +               cgroup_lock();
>>                cgroup_path(cgroup, path, sizeof(path));
>> +               cgroup_unlock();
>> +       }
>>
>>        SEQ_printf(m, "\ncfs_rq[%d]:%s\n", cpu, path);
>>  #else
>> @@ -181,8 +184,11 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
>>        if (tg)
>>                cgroup = tg->css.cgroup;
>>
>> -       if (cgroup)
>> +       if (cgroup) {
>> +               cgroup_lock();
>>                cgroup_path(cgroup, path, sizeof(path));
>> +               cgroup_unlock();
>> +       }
>>
>>        SEQ_printf(m, "\nrt_rq[%d]:%s\n", cpu, path);
>>  #else
> 
> The comment in cgroup_path() routine says that it needs to be called
> with cgroup_mutex held. With the above fix, print_task() in
> sched_debug.c remains the last caller of cgroup_path() which calls it
> without holding cgroup_mutex. Does this also need a fix ?
> 

You mean:

print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
{
	...
		cgroup_path(task_group(p)->css.cgroup, path, sizeof(path));
	...
}

Hmm...Normally we have to take task_lock() or rcu_read_lock() to retrieve
the cgroup from the task, and as long as we hold either lock, we don't need
to take cgroup_lock().

I noticed neither task_lock() nor rcu is held before calling cgroup_path,
so I wrote a test program to see if I can trigger a but here, but it didn't
happen. I'll dig more.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/