linux-kernel - Re: [RFC] coredump: Do not interrupt dump for TIF_NOTIFY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8880aac1e81ac38928f58da2d29057cb69139d8c.camel@trillion01.com>
Date:   Wed, 09 Jun 2021 17:56:30 -0400
From:   Olivier Langlois <olivier@...llion01.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        io-uring <io-uring@...r.kernel.org>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Jens Axboe <axboe@...nel.dk>,
        "Pavel Begunkov>" <asml.silence@...il.com>,
        Oleg Nesterov <oleg@...hat.com>
Subject: Re: [RFC] coredump: Do not interrupt dump for TIF_NOTIFY_SIGNAL

On Wed, 2021-06-09 at 17:26 -0400, Olivier Langlois wrote:
> On Wed, 2021-06-09 at 16:05 -0500, Eric W. Biederman wrote:
> > > 
> > > So the TIF_NOTIFY_SIGNAL does get set WHILE the core dump is
> > > written.
> > 
> > Did you mean?
> > 
> > So the TIF_NOTIFY_SIGNAL does _not_ get set WHILE the core dump is
> > written.
> > 
> > 
> Absolutely not. I did really mean what I have said. Bear with me
> that,
> I am not qualifying myself as an expert kernel dev yet so feel free
> to
> correct me if I say some heresy...
> 
> io_uring is placing my task in my TCP socket wait queue because it
> wants to read data from it.
> 
> The task returns to user space and core dump with a SEGV.
> 
> now my understanding is that the code that is waking up tasks, it is
> the NIC driver interrupt handler which can occur while the core dump
> is
> written.
> 
> does that make sense?
> 
> my testing is telling me that this is exactly what happens...
> 
> 
Another thing to know is that dump_interrupted() isn't only called from
do_coredump().

At first, I did the mistake to think that if dump_interrupt() was
returning false when called from do_coredump() all was good.

It is not the case. dump_interrupted() is also called from dump_emit()
which is called from several places by functions inside binfmt_elf.c

So dump_interrupted() is called several times during the coredump
generation.