linux-kernel - Re: Fw: Re: [PATCH] bsdacct: delete timer with sync intension

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 06 May 2010 02:44:58 +0400
From:	Vitaliy Gusev <gblond@...dex.ru>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	xemul@...nvz.org, linux-kernel@...r.kernel.org
Subject: Re: Fw: Re: [PATCH] bsdacct: delete timer with sync intension

Hi,  Andrew!

27.04.10, 15:54, "Andrew Morton" <akpm@...ux-foundation.org>:
>  On Thu, 25 Mar 2010 17:35:10 +0300
>  Vitaliy Gusev  wrote:
>  
>  > acct_exit_ns --> acct_file_reopen deletes timer without
>  > check timer execution on other CPUs. So acct_timeout() can
>  > change an unmapped memory.
>  > 
>  
>  That sounds ugly.
>  
>  > 
>  > ---
>  >  kernel/acct.c |   17 +++++++++--------
>  >  1 files changed, 9 insertions(+), 8 deletions(-)
>  > 
>  > diff --git a/kernel/acct.c b/kernel/acct.c
>  > index a6605ca..6ac80ca 100644
>  > --- a/kernel/acct.c
>  > +++ b/kernel/acct.c
>  > @@ -353,17 +353,18 @@ restart:
>  >  
>  >  void acct_exit_ns(struct pid_namespace *ns)
>  >  {
>  > - struct bsd_acct_struct *acct;
>  > + struct bsd_acct_struct *acct = ns->bacct;
>  >  
>  > - spin_lock(&acct_lock);
>  > - acct = ns->bacct;
>  > - if (acct != NULL) {
>  > - if (acct->file != NULL)
>  > - acct_file_reopen(acct, NULL, NULL);
>  > + if (acct == NULL)
>  > + return;
>  >  
>  > - kfree(acct);
>  > - }
>  > + del_timer_sync(&acct->timer);
>  > + spin_lock(&acct_lock);
>  > + if (acct->file != NULL)
>  > + acct_file_reopen(acct, NULL, NULL);
>  >   spin_unlock(&acct_lock);
>  > +
>  > + kfree(acct);
>  >  }
>  >  
>  
>  Is this sufficient?  acct_file_reopen() does a del_timer(), so
>  acct_timeout() could be running concurrently with acct_file_reopen(),
>  but acct_file_reopen() is merrily altering data at *acct.

Yes, It is sufficient. Don't mind about concurency acct_file_reopen() with
acct_timeout(). It is safe. Even if acct_timeout occurs after del_timer, then
only one bad thing can be  - set needcheck at valid *acct.

>  
>  Perhaps acct_file_reopen() should be using del_timer_sync()?

acct_file_reopen() is called within locked &acct_lock, and unlock/lock will
bring another race.


>  
>  check_free_space() is doing a similar thing:
>  
>           del_timer(&acct->timer);
>           acct->needcheck = 0;
>  
>  the currently-running timer handler now goes and sets needcheck again!

check_free_space() is called only for active task in pid_namespace.  But acct_exit_ns()
is called when there is no any  thread in pid_namespace. Thus timer handler will no set again.


>  
>  Methinks the whole thing needs a bit of a rethink, bearing in mind how
>  del_timer() actually works.
> 

--
Vitaliy Gusev
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/