linux-kernel - [PATCH] fuse: freezing abort when use wait_event_killable{,

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1480571032-31225-1-git-send-email-cuilifei@xiaomi.com>
Date:   Thu, 1 Dec 2016 13:43:52 +0800
From:   cuilifei <cuilifei@...omi.com>
To:     <linux-kernel@...r.kernel.org>
CC:     <miklos@...redi.hu>, cuilifei <cuilifei@...omi.com>
Subject: [PATCH] fuse: freezing abort when use wait_event_killable{,_exclusive}().

Freezing process can abort when a client is waiting uninterruptibly
for a response. Add new macro wait_fatal_freezable to try to fix it.

Signed-off-by: cuilifei <cuilifei@...omi.com>
---
 fs/fuse/dev.c | 47 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 4 deletions(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 70ea57c..40aea7d 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -23,6 +23,24 @@
 MODULE_ALIAS_MISCDEV(FUSE_MINOR);
 MODULE_ALIAS("devname:fuse");
 
+#define wait_fatal_freezable(wq, condition, exclusive)			\
+({									\
+	int __ret = 0;							\
+	do {								\
+		if (exclusive)						\
+			__ret = wait_event_interruptible_exclusive(wq,	\
+							condition);	\
+		else							\
+			__ret = wait_event_interruptible(wq,		\
+							condition);	\
+		if (!__ret || fatal_signal_pending(current))		\
+			break;						\
+		if (!freezing(current))					\
+			continue;					\
+	} while (try_to_freeze());					\
+	__ret;								\
+})
+
 static struct kmem_cache *fuse_req_cachep;
 
 static struct fuse_dev *fuse_get_dev(struct file *file)
@@ -99,6 +117,19 @@ void fuse_request_free(struct fuse_req *req)
 	kmem_cache_free(fuse_req_cachep, req);
 }
 
+static void block_sigs(sigset_t *oldset)
+{
+	sigset_t mask;
+
+	siginitsetinv(&mask, sigmask(SIGKILL));
+	sigprocmask(SIG_BLOCK, &mask, oldset);
+}
+
+static void restore_sigs(sigset_t *oldset)
+{
+	sigprocmask(SIG_SETMASK, oldset, NULL);
+}
+
 void __fuse_get_request(struct fuse_req *req)
 {
 	atomic_inc(&req->count);
@@ -134,13 +165,18 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
 				       bool for_background)
 {
 	struct fuse_req *req;
+	sigset_t oldset;
+	int intr;
 	int err;
 	atomic_inc(&fc->num_waiting);
 
 	if (fuse_block_alloc(fc, for_background)) {
 		err = -EINTR;
-		if (wait_event_killable_exclusive(fc->blocked_waitq,
-				!fuse_block_alloc(fc, for_background)))
+		block_sigs(&oldset);
+		intr = wait_fatal_freezable(fc->blocked_waitq,
+				!fuse_block_alloc(fc, for_background), true);
+		restore_sigs(&oldset);
+		if (intr)
 			goto out;
 	}
 	/* Matches smp_wmb() in fuse_set_initialized() */
@@ -427,9 +463,12 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
 	}
 
 	if (!test_bit(FR_FORCE, &req->flags)) {
+		sigset_t oldset;
 		/* Only fatal signals may interrupt this */
-		err = wait_event_killable(req->waitq,
-					test_bit(FR_FINISHED, &req->flags));
+		block_sigs(&oldset);
+		err = wait_fatal_freezable(req->waitq,
+				test_bit(FR_FINISHED, &req->flags), false);
+		restore_sigs(&oldset);
 		if (!err)
 			return;
 
-- 
1.9.1