linux-kernel - Re: [RFC] fuse: do not generate interrupt requests for fatal signals

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a8d0c5da-6935-4d28-9380-68b84b8e6e72@shopee.com>
Date: Thu, 13 Jun 2024 18:44:09 +0800
From: Haifeng Xu <haifeng.xu@...pee.com>
To: Miklos Szeredi <miklos@...redi.hu>
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC] fuse: do not generate interrupt requests for fatal signals



On 2024/6/13 15:55, Miklos Szeredi wrote:
> On Thu, 13 Jun 2024 at 06:02, Haifeng Xu <haifeng.xu@...pee.com> wrote:
>>
>> When the child reaper of a pid namespace exits, it invokes
>> zap_pid_ns_processes() to send SIGKILL to all processes in the
>> namespace and wait them exit. But one of the child processes get
>> stuck and its call trace like this:
>>
>> [<0>] request_wait_answer+0x132/0x210 [fuse]
>> [<0>] fuse_simple_request+0x1a8/0x2e0 [fuse]
>> [<0>] fuse_flush+0x193/0x1d0 [fuse]
>> [<0>] filp_close+0x34/0x70
>> [<0>] close_fd+0x38/0x50
>> [<0>] __x64_sys_close+0x12/0x40
>> [<0>] do_syscall_64+0x59/0xc0
>> [<0>] entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> Which process is this?

The client process is one of the processes in container. And the server process is lxcfs 
which belongs to global namespace.

> 
> In my experience such lockups are caused by badly written fuse servers.


In this case, if the interrupt request is processed before the original request is processed, 
for the arriving original request, fuse_session_process_buf_int（）which used in libfuse
invokes check_interrupt() can find the interrupt request and mark the req as interrupted, 
so the server thread which invokes fuse_lib_flush() will sleep for some time and eventually 
send reply to client without setting FUSE_INT_REQ_BIT in unique.

So why the client doesn't get woken up?


> 
>> The flags of fuse request is (FR_ISREPLY | FR_FORCE | FR_WAITING
>> | FR_INTERRUPTED | FR_SENT). For interrupt requests, fuse_dev_do_write()
>> doesn't invoke fuse_request_end() to wake the client thread, so it will
>> get stuck forever and the child reaper can't exit.
>>
>> In order to write reply to the client thread and make it exit the
>> namespace, so do not generate interrupt requests for fatal signals.
> 
> Interrupt request must be generated for all signals. Not generating
> them for SIGKILL would break existing filesystems.
> 
> Thanks,
> Miklos