linux-kernel - Re: [ 17/27] Revert "sched, autogroup: Stop going ahead if autogroup is disabled"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 07 Dec 2012 12:22:24 -0500
From:	Joseph Salisbury <joseph.salisbury@...onical.com>
To:	Ben Hutchings <ben@...adent.org.uk>
CC:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	alan@...rguk.ukuu.org.uk, Mike Galbraith <efault@....de>,
	Ingo Molnar <mingo@...nel.org>,
	Yong Zhang <yong.zhang0@...il.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [ 17/27] Revert "sched, autogroup: Stop going ahead if autogroup
 is disabled"

On 12/06/2012 07:59 PM, Greg Kroah-Hartman wrote:
> 3.6-stable review patch.  If anyone has any objections, please let me know.
>
> ------------------
>
> From: Mike Galbraith <efault@....de>
>
> commit fd8ef11730f1d03d5d6555aa53126e9e34f52f12 upstream.
>
> This reverts commit 800d4d30c8f20bd728e5741a3b77c4859a613f7c.
>
> Between commits 8323f26ce342 ("sched: Fix race in task_group()") and
> 800d4d30c8f2 ("sched, autogroup: Stop going ahead if autogroup is
> disabled"), autogroup is a wreck.
>
> With both applied, all you have to do to crash a box is disable
> autogroup during boot up, then reboot..  boom, NULL pointer dereference
> due to commit 800d4d30c8f2 not allowing autogroup to move things, and
> commit 8323f26ce342 making that the only way to switch runqueues:
>
>    BUG: unable to handle kernel NULL pointer dereference at           (null)
>    IP: [<ffffffff81063ac0>] effective_load.isra.43+0x50/0x90
>    Pid: 7047, comm: systemd-user-se Not tainted 3.6.8-smp #7 MEDIONPC MS-7502/MS-7502
>    RIP: effective_load.isra.43+0x50/0x90
>    Process systemd-user-se (pid: 7047, threadinfo ffff880221dde000, task ffff88022618b3a0)
>    Call Trace:
>      select_task_rq_fair+0x255/0x780
>      try_to_wake_up+0x156/0x2c0
>      wake_up_state+0xb/0x10
>      signal_wake_up+0x28/0x40
>      complete_signal+0x1d6/0x250
>      __send_signal+0x170/0x310
>      send_signal+0x40/0x80
>      do_send_sig_info+0x47/0x90
>      group_send_sig_info+0x4a/0x70
>      kill_pid_info+0x3a/0x60
>      sys_kill+0x97/0x1a0
>      ? vfs_read+0x120/0x160
>      ? sys_read+0x45/0x90
>      system_call_fastpath+0x16/0x1b
>    Code: 49 0f af 41 50 31 d2 49 f7 f0 48 83 f8 01 48 0f 46 c6 48 2b 07 48 8b bf 40 01 00 00 48 85 ff 74 3a 45 31 c0 48 8b 8f 50 01 00 00 <48> 8b 11 4c 8b 89 80 00 00 00 49 89 d2 48 01 d0 45 8b 59 58 4c
>    RIP  [<ffffffff81063ac0>] effective_load.isra.43+0x50/0x90
>     RSP <ffff880221ddfbd8>
>    CR2: 0000000000000000
>
> Signed-off-by: Mike Galbraith <efault@....de>
> Acked-by: Ingo Molnar <mingo@...nel.org>
> Cc: Yong Zhang <yong.zhang0@...il.com>
> Cc: Peter Zijlstra <a.p.zijlstra@...llo.nl>
> Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>
> ---
>   kernel/sched/auto_group.c |    4 ----
>   kernel/sched/auto_group.h |    5 -----
>   2 files changed, 9 deletions(-)
>
> --- a/kernel/sched/auto_group.c
> +++ b/kernel/sched/auto_group.c
> @@ -143,15 +143,11 @@ autogroup_move_group(struct task_struct
>   
>   	p->signal->autogroup = autogroup_kref_get(ag);
>   
> -	if (!ACCESS_ONCE(sysctl_sched_autogroup_enabled))
> -		goto out;
> -
>   	t = p;
>   	do {
>   		sched_move_task(t);
>   	} while_each_thread(p, t);
>   
> -out:
>   	unlock_task_sighand(p, &flags);
>   	autogroup_kref_put(prev);
>   }
> --- a/kernel/sched/auto_group.h
> +++ b/kernel/sched/auto_group.h
> @@ -4,11 +4,6 @@
>   #include <linux/rwsem.h>
>   
>   struct autogroup {
> -	/*
> -	 * reference doesn't mean how many thread attach to this
> -	 * autogroup now. It just stands for the number of task
> -	 * could use this autogroup.
> -	 */
>   	struct kref		kref;
>   	struct task_group	*tg;
>   	struct rw_semaphore	lock;
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
Hi Ben,

Will you also be including this patch in v3.5 stable?  It has been 
tested and confirmed
to resolve http://bugs.launchpad.net/bugs/1034099

Sincerely,

Joe Salisbury
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/