linux-kernel - Re: [patch V5 16/26] signal: Replace resched

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZyEhrrDhDiQ6LwjV@pavilion.home>
Date: Tue, 29 Oct 2024 18:55:58 +0100
From: Frederic Weisbecker <frederic@...nel.org>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: LKML <linux-kernel@...r.kernel.org>,
	Anna-Maria Behnsen <anna-maria@...utronix.de>,
	John Stultz <jstultz@...gle.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...nel.org>, Stephen Boyd <sboyd@...nel.org>,
	Eric Biederman <ebiederm@...ssion.com>,
	Oleg Nesterov <oleg@...hat.com>
Subject: Re: [patch V5 16/26] signal: Replace resched_timer logic

Le Tue, Oct 29, 2024 at 05:55:38PM +0100, Thomas Gleixner a écrit :
> On Tue, Oct 29 2024 at 17:34, Frederic Weisbecker wrote:
> 
> > Le Tue, Oct 29, 2024 at 05:22:17PM +0100, Thomas Gleixner a écrit :
> >> On Tue, Oct 29 2024 at 16:56, Frederic Weisbecker wrote:
> >> >> @@ -568,10 +568,10 @@ static void collect_signal(int sig, stru
> >> >>  		list_del_init(&first->list);
> >> >>  		copy_siginfo(info, &first->info);
> >> >>  
> >> >> -		*resched_timer = (first->flags & SIGQUEUE_PREALLOC) &&
> >> >> -				 (info->si_code == SI_TIMER);
> >> >> -
> >> >> -		__sigqueue_free(first);
> >> >> +		if (unlikely((first->flags & SIGQUEUE_PREALLOC) && (info->si_code == SI_TIMER)))
> >> >> +			*timer_sigq = first;
> >> >> +		else
> >> >> +			__sigqueue_free(first);
> >> >
> >> > So this isn't calling __sigqueue_free() unconditionally anymore. What if
> >> > the timer has been freed already, what is going to free the sigqueue?
> >> 
> >> __sigqueue_free() does not free timers marked with SIGQUEUE_PREALLOC.
> >> 
> >> sigqueue_free() takes care of that, which is invoked from
> >> posixtimer_free_timer(). It clears SIGQUEUE_PREALLOC and if it is queued
> >> it lets it pending and delivery will free it.
> >
> > But the delivery freeing used to be done with the __sigqueue_free()
> > above, which doesn't happen anymore, right?
> 
> It still happens because SIGQUEUE_PREALLOC is cleared in sigqueue_free()
> 
> __sigqueue_free() has
>        if (q->flags & PREALLOC)
>        	     return;
> 
> So the old code called __sigqueue_free() unconditionally which just
> returned. But now we have a condition to that effect already, so why
> call into __sigqueue_free() for nothing?

1) Signal is queued
2) Timer is deleted, sigqueue() clears SIGQUEUE_PREALLOC but doesn't go
   further because the sigqueue is queued
3) Signal is collected and delivered but it's not calling __sigqueue_free()
   so the sigqueue is not released.

This is "fixed" on the subsequent patch which uses embedded sigqueue and
rcuref but this patch alone breaks.

Or am I missing something that prevents it?

Thanks.