linux-kernel - Re: [PATCH] sched: fix another race when reading /proc/sched

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081219043702.GA5453@balbir.in.ibm.com>
Date:	Fri, 19 Dec 2008 10:07:02 +0530
From:	Balbir Singh <balbir@...ux.vnet.ibm.com>
To:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc:	Li Zefan <lizf@...fujitsu.com>, Ingo Molnar <mingo@...e.hu>,
	Paul Menage <menage@...gle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] sched: fix another race when reading /proc/sched_debug

* Peter Zijlstra <a.p.zijlstra@...llo.nl> [2008-12-14 13:48:10]:

> On Sun, 2008-12-14 at 10:54 +0800, Li Zefan wrote:
> > > i merged it up in tip/master, could you please check whether it's ok?
> > > 
> > 
> > Sorry, though this patch avoids accessing a half-created cgroup, but I found
> > current code may access a cgroup which has been destroyed.
> > 
> > The simplest fix is to take cgroup_lock() before for_each_leaf_cfs_rq.
> > 
> > Could you revert this patch and apply the following new one? My box has
> > survived for 16 hours with it applied.
> > 
> > ==========
> > 
> > From: Li Zefan <lizf@...fujitsu.com>
> > Date: Sun, 14 Dec 2008 09:53:28 +0800
> > Subject: [PATCH] sched: fix another race when reading /proc/sched_debug
> > 
> > I fixed an oops with the following commit:
> > 
> > | commit 24eb089950ce44603b30a3145a2c8520e2b55bb1
> > | Author: Li Zefan <lizf@...fujitsu.com>
> > | Date:   Thu Nov 6 12:53:32 2008 -0800
> > |
> > |    cgroups: fix invalid cgrp->dentry before cgroup has been completely removed
> > |
> > |    This fixes an oops when reading /proc/sched_debug.
> > 
> > The above commit fixed a race that reading /proc/sched_debug may access
> > NULL cgrp->dentry if a cgroup is being removed (via cgroup_rmdir), but
> > hasn't been destroyed (via cgroup_diput).
> > 
> > But I found there's another different race, in that reading sched_debug
> > may access a cgroup which is being created or has been destroyed, and thus
> > dereference NULL cgrp->dentry!
> > 
> > task_group is added to the global list while the cgroup is being created,
> > and is removed from the global list while the cgroup is under destruction.
> > So running through the list should be protected by cgroup_lock(), if
> > cgroup data will be accessed (here by calling cgroup_path).
> 
> Can't we detect a dead task-group and skip those instead of adding this
> global lock?
> 

Now we can, there is a css_is_removed() function.

-- 
	Balbir
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/