linux-kernel - Re: [PATCH] pid: Allow frozen userspace to reboot from non-init pid ns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJZ5v0g6160NYtRQun0D_qS-R6NfoXrX47muWt+sTN3wnNyHeA@mail.gmail.com>
Date:   Thu, 12 Oct 2023 11:48:24 +0200
From:   "Rafael J. Wysocki" <rafael@...nel.org>
To:     Brian Geffon <bgeffon@...gle.com>
Cc:     Christian Brauner <brauner@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        "Rafael J . Wysocki" <rafael@...nel.org>,
        Matthias Kaehlcke <mka@...omium.org>,
        Luis Chamberlain <mcgrof@...nel.org>,
        Frederic Weisbecker <frederic@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] pid: Allow frozen userspace to reboot from non-init pid ns

On Fri, Sep 29, 2023 at 7:45 PM Brian Geffon <bgeffon@...gle.com> wrote:
>
> When the system has a frozen userspace, for example, during hibernation
> the child reaper task will also be frozen. Attmepting to deliver a
> signal to it to handle the reboot(2) will ultimately lead to the system
> hanging unless userspace is thawed.
>
> This change checks if the current task is the suspending task and if so
> it will allow it to proceed with a reboot from the non-init pid ns.
>
> Signed-off-by: Brian Geffon <bgeffon@...gle.com>
> Reported-by: Matthias Kaehlcke <mka@...omium.org>
> Tested-by: Matthias Kaehlcke <mka@...omium.org>

If the report is public, which I think is the case, having a Link: tag
pointing to it here would be nice.

> ---
>  kernel/pid_namespace.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
> index 0bf44afe04dd..4a93a5063eda 100644
> --- a/kernel/pid_namespace.c
> +++ b/kernel/pid_namespace.c
> @@ -321,6 +321,15 @@ int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
>         if (pid_ns == &init_pid_ns)
>                 return 0;
>
> +       if (current->flags & PF_SUSPEND_TASK) {
> +               /*
> +                * Attempting to signal the child_reaper won't work if it's
> +                * frozen. In this case we shutdown the system as if we were in
> +                * the init_pid_ns.
> +                */

Is the system guaranteed to be in the right state for a shutdown at this point?

There is a system-wide suspend-resume or hibernation in progress, so
system_transition_mutex should be held and that should cause reboot()
to block anyway.  Do you know why it doesn't block and why the suspend
task has any reason to call it?

> +               return 0;
> +       }
> +
>         switch (cmd) {
>         case LINUX_REBOOT_CMD_RESTART2:
>         case LINUX_REBOOT_CMD_RESTART:
> --
> 2.42.0.582.g8ccd20d70d-goog
>