linux-kernel - Re: [PATCH v4 12/12] sched,signal,ptrace: Rework TASK_TRACED, TASK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Jun 2022 22:25:40 +0200
From:   Alexander Gordeev <agordeev@...ux.ibm.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Steven Rostedt <rostedt@...dmis.org>, linux-kernel@...r.kernel.org,
        rjw@...ysocki.net, Oleg Nesterov <oleg@...hat.com>,
        mingo@...nel.org, vincent.guittot@...aro.org,
        dietmar.eggemann@....com, mgorman@...e.de, bigeasy@...utronix.de,
        Will Deacon <will@...nel.org>, tj@...nel.org,
        linux-pm@...r.kernel.org, Peter Zijlstra <peterz@...radead.org>,
        Richard Weinberger <richard@....at>,
        Anton Ivanov <anton.ivanov@...bridgegreys.com>,
        Johannes Berg <johannes@...solutions.net>,
        linux-um@...ts.infradead.org, Chris Zankel <chris@...kel.net>,
        Max Filippov <jcmvbkbc@...il.com>,
        linux-xtensa@...ux-xtensa.org, Kees Cook <keescook@...omium.org>,
        Jann Horn <jannh@...gle.com>, linux-ia64@...r.kernel.org
Subject: Re: [PATCH v4 12/12] sched,signal,ptrace: Rework TASK_TRACED,
 TASK_STOPPED state

On Tue, Jun 28, 2022 at 10:39:59PM -0500, Eric W. Biederman wrote:
> Steven Rostedt <rostedt@...dmis.org> writes:
> 
> > On Tue, 28 Jun 2022 17:42:22 -0500
> > "Eric W. Biederman" <ebiederm@...ssion.com> wrote:
> >
> >> diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> >> index 156a99283b11..cb85bcf84640 100644
> >> --- a/kernel/ptrace.c
> >> +++ b/kernel/ptrace.c
> >> @@ -202,6 +202,7 @@ static bool ptrace_freeze_traced(struct task_struct *task)
> >>  	spin_lock_irq(&task->sighand->siglock);
> >>  	if (task_is_traced(task) && !looks_like_a_spurious_pid(task) &&
> >>  	    !__fatal_signal_pending(task)) {
> >> +		smp_rmb();
> >>  		task->jobctl |= JOBCTL_PTRACE_FROZEN;
> >>  		ret = true;
> >>  	}
> >> diff --git a/kernel/signal.c b/kernel/signal.c
> >> index edb1dc9b00dc..bcd576e9de66 100644
> >> --- a/kernel/signal.c
> >> +++ b/kernel/signal.c
> >> @@ -2233,6 +2233,7 @@ static int ptrace_stop(int exit_code, int why, unsigned long message,
> >>  		return exit_code;
> >>  
> >>  	set_special_state(TASK_TRACED);
> >> +	smp_wmb();
> >>  	current->jobctl |= JOBCTL_TRACED;
> >>  
> >
> > Are not these both done under the sighand->siglock spinlock?
> >
> > That is, the two paths should already be synchronized, and the memory
> > barriers will not help anything inside the locks. The locking should (and
> > must) handle all that.
> 
> I would presume so to.  However the READ_ONCE that is going astray
> does not look like it is honoring that.
> 
> So perhaps there is a bug in the s390 spin_lock barriers?  Perhaps there
> is a subtle detail in the barriers that spin locks provide that we are
> overlooking?
> 
> I just know the observed behavior is:
> 
> - reading tsk->jobctl and seeing  JOBCTL_TRACED set.
> - reading tsk->__state and seeing TASK_RUNNING.
> 
> So unless PREEMPT_RT is enabled on s390.  It looks like there is a
> barrier problem.
> 
> Alexander do you have PREEMPT_RT enabled on s390?  I have been assuming
> you don't but I figure I should ask and make certain as PREEMPT_RT can
> cause this kind of failure.

There is no change with the barriers added.

CONFIG_PREEMPT_RT is disabled and CONFIG_LOCKDEP is enabled (in attach).
FWIW, I also added a full barrier:

@@ -271,6 +272,7 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
        if (!ret && !ignore_state) {
                unsigned int __state;
 
+               smp_mb();
                WARN_ON_ONCE(!(child->jobctl & JOBCTL_PTRACE_FROZEN));
                WARN_ON_ONCE(!(child->jobctl & JOBCTL_TRACED));
                __state = READ_ONCE(child->__state);

I have not been able to extract the ftrace ring buffer yet - going to do that.

> Eric

Thanks!

View attachment "config-5.19.0-rc4-08751-g2cf560748ed6" of type "text/plain" (87569 bytes)