linux-kernel - [PATCH 1/2] freezer,sched: do not restore saved

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231120-freezer-state-multiple-thaws-v1-1-f2e1dd7ce5a2@quicinc.com>
Date:   Mon, 20 Nov 2023 09:36:31 -0800
From:   Elliot Berman <quic_eberman@...cinc.com>
To:     "Rafael J. Wysocki" <rafael@...nel.org>,
        Pavel Machek <pavel@....cz>, "Ingo Molnar" <mingo@...nel.org>,
        "Peter Zijlstra (Intel)" <peterz@...radead.org>
CC:     <linux-arm-msm@...r.kernel.org>,
        Pavan Kondeti <quic_pkondeti@...cinc.com>,
        "Aiqun Yu (Maria)" <quic_aiquny@...cinc.com>,
        <linux-pm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        Elliot Berman <quic_eberman@...cinc.com>,
        Abhijeet Dharmapurikar <quic_adharmap@...cinc.com>
Subject: [PATCH 1/2] freezer,sched: do not restore saved_state of a thawed
 task

It is possible for a task to be thawed multiple times when mixing the
*legacy* cgroup freezer and system-wide freezer. To do this, freeze the
cgroup, do system-wide freeze/thaw, then thaw the cgroup. When this
happens, then a stale saved_state can be written to the task's state
and cause task to hang indefinitely. Fix this by only trying to thaw
tasks that are actually frozen.

This change also has the marginal benefit avoiding unnecessary
wake_up_state(p, TASK_FROZEN) if we know the task is already thawed.
There is not possibility of time-of-compare/time-of-use race when we skip
the wake_up_state because entering/exiting TASK_FROZEN is guarded by
freezer_lock.

Fixes: 8f0eed4a78a8 ("freezer,sched: Use saved_state to reduce some spurious wakeups")
Reviewed-by: Abhijeet Dharmapurikar <quic_adharmap@...cinc.com>
Signed-off-by: Elliot Berman <quic_eberman@...cinc.com>
---
 kernel/freezer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/freezer.c b/kernel/freezer.c
index c450fa8b8b5e..759006a9a910 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -201,7 +201,7 @@ void __thaw_task(struct task_struct *p)
 	if (WARN_ON_ONCE(freezing(p)))
 		goto unlock;

-	if (task_call_func(p, __restore_freezer_state, NULL))
+	if (!frozen(p) || task_call_func(p, __restore_freezer_state, NULL))
 		goto unlock;

 	wake_up_state(p, TASK_FROZEN);

-- 
2.41.0