[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20210107075314.62683-1-wenyang@linux.alibaba.com>
Date: Thu, 7 Jan 2021 15:53:07 +0800
From: Wen Yang <wenyang@...ux.alibaba.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Sasha Levin <sashal@...nel.org>
Cc: Xunlei Pang <xlpang@...ux.alibaba.com>,
linux-kernel@...r.kernel.org, Wen Yang <wenyang@...ux.alibaba.com>
Subject: [PATCH 4.19 0/7] fix a race in release_task when flushing the dentry
The dentries such as /proc/<pid>/ns/ have the DCACHE_OP_DELETE flag, they
should be deleted when the process exits.
Suppose the following race appears:
release_task dput
-> proc_flush_task
-> dentry->d_op->d_delete(dentry)
-> __exit_signal
-> dentry->d_lockref.count-- and return.
In the proc_flush_task(), if another process is using this dentry, it will
not be deleted. At the same time, in dput(), d_op->d_delete() can be executed
before __exit_signal(pid has not been hashed), d_delete returns false, so
this dentry still cannot be deleted.
This dentry will always be cached (although its count is 0 and the
DCACHE_OP_DELETE flag is set), its parent denry will also be cached too, and
these dentries can only be deleted when drop_caches is manually triggered.
This will result in wasted memory. What's more troublesome is that these
dentries reference pid, according to the commit f333c700c610 ("pidns: Add a
limit on the number of pid namespaces"), if the pid cannot be released, it
may result in the inability to create a new pid_ns.
This issue was introduced by 60347f6716aa ("pid namespaces: prepare
proc_flust_task() to flush entries from multiple proc trees"), exposed by
f333c700c610 ("pidns: Add a limit on the number of pid namespaces"), and then
fixed by 7bc3e6e55acf ("proc: Use a list of inodes to flush from proc").
Christian Brauner (1):
clone: add CLONE_PIDFD
Eric W. Biederman (5):
proc: Rename in proc_inode rename sysctl_inodes sibling_inodes
proc: Generalize proc_sys_prune_dcache into proc_prune_siblings_dcache
proc: Clear the pieces of proc_inode that proc_evict_inode cares about
proc: Use d_invalidate in proc_prune_siblings_dcache
proc: Use a list of inodes to flush from proc
Joel Fernandes (Google) (1):
pidfd: add polling support
fs/proc/base.c | 111 ++++++++++++-------------------------
fs/proc/inode.c | 67 +++++++++++++++++++++--
fs/proc/internal.h | 4 +-
fs/proc/proc_sysctl.c | 45 ++-------------
include/linux/pid.h | 6 ++
include/linux/proc_fs.h | 4 +-
include/uapi/linux/sched.h | 1 +
kernel/exit.c | 4 +-
kernel/fork.c | 133 +++++++++++++++++++++++++++++++++++++++++++--
kernel/pid.c | 3 +
kernel/signal.c | 11 ++++
11 files changed, 262 insertions(+), 127 deletions(-)
--
1.8.3.1
Powered by blists - more mailing lists