linux-kernel - [PATCH] fs/userfaultfd: Don't try to freeze uninterruptible tasks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Oct 2017 10:51:55 +0100
From:   Will Deacon <will.deacon@....com>
To:     linux-kernel@...r.kernel.org
Cc:     Will Deacon <will.deacon@....com>,
        Mark Rutland <mark.rutland@....com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Andrea Arcangeli <aarcange@...hat.com>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>, <stable@...r.kernel.org>
Subject: [PATCH] fs/userfaultfd: Don't try to freeze uninterruptible tasks

The userfaultfd code sets the faulting task's state to TASK_KILLABLE for faults
originating from kernel accesses, which prevents the task being frozen during a
hibernate operation. For example, setting a userfaultfd region to trigger on
the signal stack leads to a task that requires a fatal signal in order to exit
after the kernel has failed to push a sigframe for a prior non-fatal signal.
Such a task causes hibernation to fail as follows and can be achieved without
additional privilege:

  Freezing user space processes ...
  Freezing of tasks failed after 20.007 seconds (1 tasks refusing to freeze, wq_busy=0):
  uaccess-repro   D    0 11213   9853 0x00000004
  Call Trace:
   __schedule+0x245/0x880
   schedule+0x36/0x80
   handle_userfault+0x28f/0x670
   ? userfaultfd_ctx_get+0x40/0x40
   __handle_mm_fault+0xf92/0xfa0
   handle_mm_fault+0xd8/0x240
   __do_page_fault+0x23f/0x4c0
   do_page_fault+0x22/0x30
   page_fault+0x28/0x30
  RIP: 0010:__clear_user+0x25/0x50
  RSP: 0018:ffffb098029b3d70 EFLAGS: 00050202
  RAX: 0000000000000000 RBX: 00007f5830336c80 RCX: 0000000000000008
  RDX: 0000000000000000 RSI: 0000000000000008 RDI: 00007f5830336e80
  RBP: ffffb098029b3d70 R08: 0000000000000344 R09: 000000000000000c
  R10: ffffb098029b3d37 R11: ffff92b58c0cc380 R12: ffff92b58c0cc380
  R13: 00007f5830336c80 R14: ffffb098029b3e18 R15: ffff92b58c0ccdf8
   copy_fpstate_to_sigframe+0x91/0x1f0
   get_sigframe.isra.13.constprop.14+0x1aa/0x1d0
   do_signal+0x1c4/0x740
   ? SYSC_kill+0xeb/0x1a0
   ? alloc_file+0x1d/0xc0
   exit_to_usermode_loop+0x80/0xd0
   syscall_return_slowpath+0x59/0x60
   entry_SYSCALL_64_fastpath+0xa7/0xa9

This patch fixes the problem by informing the freezer code that the task does
not require to be frozen when in an uninterruptible state.

Cc: Mark Rutland <mark.rutland@....com>
Cc: Al Viro <viro@...iv.linux.org.uk>
Cc: Andrea Arcangeli <aarcange@...hat.com>
Cc: "Rafael J. Wysocki" <rjw@...ysocki.net>
Cc: <stable@...r.kernel.org>
Signed-off-by: Will Deacon <will.deacon@....com>
---
 fs/userfaultfd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index ef4b48d1ea42..974f2dd4e711 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -29,6 +29,7 @@
 #include <linux/ioctl.h>
 #include <linux/security.h>
 #include <linux/hugetlb.h>
+#include <linux/freezer.h>
 
 static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
 
@@ -481,6 +482,7 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
 		   (return_to_userland ? !signal_pending(current) :
 		    !fatal_signal_pending(current)))) {
 		wake_up_poll(&ctx->fd_wqh, POLLIN);
+		freezer_do_not_count();
 		schedule();
 		ret |= VM_FAULT_MAJOR;
 
@@ -504,8 +506,10 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
 			    (return_to_userland ? signal_pending(current) :
 			     fatal_signal_pending(current)))
 				break;
+
 			schedule();
 		}
+		freezer_count();
 	}
 
 	__set_current_state(TASK_RUNNING);
-- 
2.1.4