linux-kernel - [PATCH 18/20] signal: Add calculate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180724032419.20231-18-ebiederm@xmission.com>
Date:   Mon, 23 Jul 2018 22:24:17 -0500
From:   "Eric W. Biederman" <ebiederm@...ssion.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Oleg Nesterov <oleg@...hat.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-kernel@...r.kernel.org, Wen Yang <wen.yang99@....com.cn>,
        majiang <ma.jiang@....com.cn>,
        "Eric W. Biederman" <ebiederm@...ssion.com>
Subject: [PATCH 18/20] signal: Add calculate_sigpending()

Add a function calculate_sigpending to test to see if any signals are
pending for a new task immediately following fork.  Signals have to
happen either before or after fork.  Today our practice is to push
all of the signals to before the fork, but that has the downside that
frequent or periodic signals can make fork take much much longer than
normal or prevent fork from completing entirely.

So we need move signals that we can after the fork to prevent that.

This updates the code to set TIF_SIGPENDING on a new task if there
are signals or other activities that have moved so that they appear
to happen after the fork.

As the code today restarts if it sees any such activity this won't
immediately have an effect, as there will be no reason for it
to set TIF_SIGPENDING immediately after the fork.

Adding calculate_sigpending means the code in fork can safely be
changed to not always restart if a signal is pending.

The new calculate_sigpending function sets sigpending if there
are pending bits in jobctl, pending signals, the freezer needs
to freeze the new task or the live kernel patching framework
need the new thread to take the slow path to userspace.

I have verified that setting TIF_SIGPENDING does make a new process
take the slow path to userspace before it executes it's first userspace
instruction.

I have looked at the callers of signal_wake_up and the code paths
setting TIF_SIGPENDING and I don't see else that needs to be handled.
The code probably doesn't need to set TIF_SIGPENDING for the kernel
live patching as it uses a separate thread flag as well.  But at this
point it seems safer to copy recalc_sigpending and get the kernel live
patching folks to sort out their story later.

Signed-off-by: "Eric W. Biederman" <ebiederm@...ssion.com>
---
 include/linux/sched/signal.h |  1 +
 kernel/fork.c                |  1 +
 kernel/signal.c              | 13 +++++++++++++
 3 files changed, 15 insertions(+)

diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index 94558ffa82ab..7cabc0bc38f6 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -372,6 +372,7 @@ static inline int signal_pending_state(long state, struct task_struct *p)
  */
 extern void recalc_sigpending_and_wake(struct task_struct *t);
 extern void recalc_sigpending(void);
+extern void calculate_sigpending(struct task_struct *new);

 extern void signal_wake_up_state(struct task_struct *t, unsigned int state);

diff --git a/kernel/fork.c b/kernel/fork.c
index 22d4cdb9a7ca..e07281254552 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1988,6 +1988,7 @@ static __latent_entropy struct task_struct *copy_process(
 					  &p->signal->thread_head);
 		}
 		attach_pid(p, PIDTYPE_PID);
+		calculate_sigpending(p);
 		nr_threads++;
 	}

diff --git a/kernel/signal.c b/kernel/signal.c
index dddbea558455..f6687c7d7a8c 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -172,6 +172,19 @@ void recalc_sigpending(void)

 }

+void calculate_sigpending(struct task_struct *new)
+{
+	/* Have any signals or users of TIF_SIGPENDING been delayed
+	 * until after fork?
+	 */
+	bool pending = (new->jobctl & JOBCTL_PENDING_MASK) ||
+		PENDING(&new->pending, &new->blocked) ||
+		PENDING(&new->signal->shared_pending, &new->blocked) ||
+		freezing(new) || klp_patch_pending(new);
+
+	update_tsk_thread_flag(new, TIF_SIGPENDING, pending);
+}
+
 /* Given the mask, find the first available signal that should be serviced. */

 #define SYNCHRONOUS_MASK \
-- 
2.17.1