linux-kernel - Re: [PATCH 2.6.35-rc3] Add RCU check for find_task_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 26 Jun 2010 07:41:06 +0900
From:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:	paulmck@...ux.vnet.ibm.com
Cc:	mingo@...e.hu, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2.6.35-rc3] Add RCU check for find_task_by_vpid().

Hello.

Paul E. McKenney wrote:
> > diff --git a/kernel/pid.c b/kernel/pid.c
> > index e9fd8c1..a257471 100644
> > --- a/kernel/pid.c
> > +++ b/kernel/pid.c
> > @@ -382,6 +382,9 @@ EXPORT_SYMBOL(pid_task);
> >   */
> >  struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
> >  {
> > +#ifdef __do_rcu_dereference_check
> > +	__do_rcu_dereference_check(rcu_read_lock_held());
> > +#endif
> 
> How about the following?
> 
> 	WARN_ON_ONCE(!rcu_read_lock_held());
> 
> >  	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
> >  }
> > 
Fine by me if you don't mind WARN_ON_ONCE(!1); for CONFIG_DEBUG_LOCK_ALLOC=n .
Personally,

> >   ===================================================
> >   [ INFO: suspicious rcu_dereference_check() usage. ]
> >   ---------------------------------------------------
> >   kernel/pid.c:386 invoked rcu_dereference_check() without protection!
> >   
> >   other info that might help us debug this:
> >   
> >   
> >   rcu_scheduler_active = 1, debug_locks = 1
> >   1 lock held by rc.sysinit/1102:
> >    #0:  (tasklist_lock){.+.+..}, at: [<c1048340>] sys_setpgid+0x40/0x160
> >   
> >   stack backtrace:
> >   Pid: 1102, comm: rc.sysinit Not tainted 2.6.35-rc3-dirty #1
> >   Call Trace:
> >    [<c105e714>] lockdep_rcu_dereference+0x94/0xb0
> >    [<c104b4cd>] find_task_by_pid_ns+0x6d/0x70
> >    [<c104b4e8>] find_task_by_vpid+0x18/0x20
> >    [<c1048347>] sys_setpgid+0x47/0x160
> >    [<c1002b50>] sysenter_do_call+0x12/0x36

is more helpful messages than messages by WARN_ON() (shown below).

Regards.
----------------------------------------
[PATCH 2.6.35-rc3] Add RCU check for find_task_by_vpid().

find_task_by_vpid() says "Must be called under rcu_read_lock().". But due to
commit 3120438 "rcu: Disable lockdep checking in RCU list-traversal primitives",
we are currently unable to catch "find_task_by_vpid() with tasklist_lock held
but RCU not held" errors.

  ------------[ cut here ]------------
  WARNING: at kernel/pid.c:385 find_task_by_pid_ns+0x5b/0x70()
  Hardware name: VMware Virtual Platform
  Modules linked in: mptspi mptscsih mptbase scsi_transport_spi
  Pid: 1102, comm: rc.sysinit Not tainted 2.6.35-rc3-dirty #1
  Call Trace:
   [<c104b4bb>] ? find_task_by_pid_ns+0x5b/0x70
   [<c103783c>] warn_slowpath_common+0x7c/0xa0
   [<c104b4bb>] ? find_task_by_pid_ns+0x5b/0x70
   [<c103787d>] warn_slowpath_null+0x1d/0x20
   [<c104b4bb>] find_task_by_pid_ns+0x5b/0x70
   [<c104b4e8>] find_task_by_vpid+0x18/0x20
   [<c1048347>] sys_setpgid+0x47/0x160
   [<c1002b50>] sysenter_do_call+0x12/0x36
  ---[ end trace e68939acb5ea5560 ]---

Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
---
diff --git a/kernel/pid.c b/kernel/pid.c
index e9fd8c1..7123215 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -382,6 +382,7 @@ EXPORT_SYMBOL(pid_task);
  */
 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
 {
+	WARN_ON_ONCE(!rcu_read_lock_held());
 	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
 }
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/