linux-kernel - Re: [PATCH v2] kernel/exit: do panic earlier to get coredump if global init task exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 16 Dec 2019 11:27:59 +0100
From:   Christian Brauner <christian.brauner@...ntu.com>
To:     qiwuchen55@...il.com
Cc:     peterz@...radead.org, mingo@...nel.org, oleg@...hat.com,
        kernel-team@...roid.com, linux-kernel@...r.kernel.org,
        chenqiwu@...omi.com
Subject: Re: [PATCH v2] kernel/exit: do panic earlier to get coredump if
 global init task exit

On Mon, Dec 16, 2019 at 11:18:44AM +0800, qiwuchen55@...il.com wrote:
> From: chenqiwu <chenqiwu@...omi.com>
> 
> When global init task get a chance to be killed, panic will happen in
> later calling steps by do_exit()->exit_notify()->forget_original_parent()
> ->find_child_reaper() if all init threads have exited.
> 
> However, it's hard to extract the coredump of init task from a kernel
> crashdump, since exit_mm() has released its mm before panic. In order
> to get the backtrace of init task in userspace, it's better to do panic
> earlier at the beginning of exitting route.
> 
> It's worth noting that we must take case of a multi-threaded init exitting
> issue. We need the test for is_global_init() && group_dead to ensure that
> it is all of init threads exiting and not just the current thread.
> 
> Signed-off-by: chenqiwu <chenqiwu@...omi.com>

Just a comment and a nit I can fixup myself.

Reviewed-by: Christian Brauner <christian.brauner@...ntu.com>

Oleg, wdyt?

> ---
> changes in v2:
>  - using is_global_init() && group_dead as panic condition.
>  - move up group_dead = atomic_dec_and_test(&tsk->signal->live).
>  - add comment for this change in do_exit().
> ---
>  kernel/exit.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/kernel/exit.c b/kernel/exit.c
> index bcbd598..33364c8 100644
> --- a/kernel/exit.c
> +++ b/kernel/exit.c
> @@ -517,10 +517,6 @@ static struct task_struct *find_child_reaper(struct task_struct *father,
>  	}
>  
>  	write_unlock_irq(&tasklist_lock);
> -	if (unlikely(pid_ns == &init_pid_ns)) {
> -		panic("Attempted to kill init! exitcode=0x%08x\n",
> -			father->signal->group_exit_code ?: father->exit_code);
> -	}

This made me queasy at first but from what I can see this is safe to remove.
We could've only gotten here if:
task == child_reaper && !find_alive_thread() && pid_ns == init_pid_ns
that should be equivalent to the new
is_global_init(tsk) && group_dead
check, i.e. I think there's no condition we might loose by removing this
check.

>  
>  	list_for_each_entry_safe(p, n, dead, ptrace_entry) {
>  		list_del_init(&p->ptrace_entry);
> @@ -728,6 +724,14 @@ void __noreturn do_exit(long code)
>  		panic("Attempted to kill the idle task!");
>  
>  	/*
> +	 * If all threads of global init have exited, do panic imeddiately

Nit: s/imeddiately/immediately/

but I can fix this up when applying.

> +	 * to get the coredump to find any clue for init task in userspace.
> +	 */
> +	group_dead = atomic_dec_and_test(&tsk->signal->live);
> +	if (unlikely(is_global_init(tsk) && group_dead))
> +		panic("Attempted to kill init! exitcode=0x%08lx\n", code);
> +
> +	/*
>  	 * If do_exit is called because this processes oopsed, it's possible
>  	 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
>  	 * continuing. Amongst other possible reasons, this is to prevent
> @@ -764,7 +768,6 @@ void __noreturn do_exit(long code)
>  	if (tsk->mm)
>  		sync_mm_rss(tsk->mm);
>  	acct_update_integrals(tsk);
> -	group_dead = atomic_dec_and_test(&tsk->signal->live);
>  	if (group_dead) {
>  #ifdef CONFIG_POSIX_TIMERS
>  		hrtimer_cancel(&tsk->signal->real_timer);
> -- 
> 1.9.1
>