linux-kernel - Re: [PATCH v2 -next] cgroup/pids: Avoid spurious event notification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zqll1sNJB4qQc0s2@slm.duckdns.org>
Date: Tue, 30 Jul 2024 12:14:46 -1000
From: Tejun Heo <tj@...nel.org>
To: Xiu Jianfeng <xiujianfeng@...weicloud.com>
Cc: lizefan.x@...edance.com, hannes@...xchg.org, mkoutny@...e.com,
	cgroups@...r.kernel.org, linux-kernel@...r.kernel.org,
	xiujianfeng@...wei.com
Subject: Re: [PATCH v2 -next] cgroup/pids: Avoid spurious event notification

On Tue, Jul 30, 2024 at 03:29:20AM +0000, Xiu Jianfeng wrote:
> From: Xiu Jianfeng <xiujianfeng@...wei.com>
> 
> Currently when a process in a group forks and fails due to it's
> parent's max restriction, all the cgroups from 'pids_forking' to root
> will generate event notifications but only the cgroups from
> 'pids_over_limit' to root will increase the counter of PIDCG_MAX.
> 
> Consider this scenario: there are 4 groups A, B, C,and D, the
> relationships are as follows, and user is watching on C.pids.events.
> 
> root->A->B->C->D
> 
> When a process in D forks and fails due to B.max restriction, the
> user will get a spurious event notification because when he wakes up
> and reads C.pids.events, he will find that the content has not changed.
> 
> To address this issue, only the cgroups from 'pids_over_limit' to root
> will have their PIDCG_MAX counters increased and event notifications
> generated.
> 
> Fixes: 385a635cacfe ("cgroup/pids: Make event counters hierarchical")
> Signed-off-by: Xiu Jianfeng <xiujianfeng@...wei.com>

Applied to cgroup/for-6.12.

Note that spurious events are explicitly allowed. Anyone watching an events
file should keep track of the reported values to detect actual events.

Thanks.

-- 
tejun