linux-kernel - Re: Userfaultfd doesn't seem to break out of poll on fd close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200414223410.GM5100@ziepe.ca>
Date:   Tue, 14 Apr 2020 19:34:10 -0300
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Peter Xu <peterx@...hat.com>
Cc:     Brian Geffon <bgeffon@...gle.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        linux-mm <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Sonny Rao <sonnyrao@...gle.com>
Subject: Re: Userfaultfd doesn't seem to break out of poll on fd close

On Tue, Apr 14, 2020 at 05:45:16PM -0400, Peter Xu wrote:
> On Sun, Apr 12, 2020 at 01:10:40PM -0700, Brian Geffon wrote:
> > Hi,
> > It seems that userfaultfd isn't woken from a poll when the file
> > descriptor is closed. It seems that it should be from the code in
> > userfault_ctx_release, but it appears that's not actually called
> > immediately. I have a simple standalone example that shows this
> > behavior. It's straight forward: one thread creates a userfaultfd and
> > then closes it after a second thread has entered a poll syscall, some
> > abbreviated strace output is below showing this and the code can be
> > seen here: https://gist.github.com/bgaff/9a8fbbe8af79c0e18502430d416df77e
> > 
> > Given that it's probably very common to have a dedicated thread remain
> > blocked indefinitely in a poll(2) waiting for faults there must be a
> > way to break it out early when it's closed. Am I missing something?
> 
> Hi, Brian,
> 
> I might be wrong below, just to share my understanding...
> 
> IMHO a well-behaved userspace should not close() on a file descriptor
> if it's still in use within another thread.  In this case, the poll()
> thread is still using the userfaultfd handle

I also don't think concurrant close() on a file descriptor that is
under poll() is well defined, or should be relied upon.

> IIUC userfaultfd_release() is only called when the file descriptor
> destructs itself.  But shouldn't the poll() take a refcount of that
> file descriptor too before waiting?  Not sure userfaultfd_release() is
> the place to kick then, because if so, close() will only decrease the
> fd refcount from 2->1, and I'm not sure userfaultfd_release() will be
> triggered.

This is most probably true.

eventfd, epoll and pthread_join is the robust answer to these
problems.

Jason