linux-kernel - Re: [PATCH v2 2/4] net, pidfs: prepare for handing out pidfds for reaped sk->sk_peer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250425204632.44889-1-kuniyu@amazon.com>
Date: Fri, 25 Apr 2025 13:46:05 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <brauner@...nel.org>
CC: <alexander@...alicyn.com>, <bluca@...ian.org>, <daan.j.demeyer@...il.com>,
	<davem@...emloft.net>, <david@...dahead.eu>, <edumazet@...gle.com>,
	<horms@...nel.org>, <jack@...e.cz>, <kuba@...nel.org>, <kuniyu@...zon.com>,
	<lennart@...ttering.net>, <linux-fsdevel@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <me@...dnzj.com>, <netdev@...r.kernel.org>,
	<oleg@...hat.com>, <pabeni@...hat.com>
Subject: Re: [PATCH v2 2/4] net, pidfs: prepare for handing out pidfds for reaped sk->sk_peer_pid

From: Christian Brauner <brauner@...nel.org>
Date: Fri, 25 Apr 2025 10:11:31 +0200
> SO_PEERPIDFD currently doesn't support handing out pidfds if the
> sk->sk_peer_pid thread-group leader has already been reaped. In this
> case it currently returns EINVAL. Userspace still wants to get a pidfd
> for a reaped process to have a stable handle it can pass on.
> This is especially useful now that it is possible to retrieve exit
> information through a pidfd via the PIDFD_GET_INFO ioctl()'s
> PIDFD_INFO_EXIT flag.
> 
> Another summary has been provided by David in [1]:
> 
> > A pidfd can outlive the task it refers to, and thus user-space must
> > already be prepared that the task underlying a pidfd is gone at the time
> > they get their hands on the pidfd. For instance, resolving the pidfd to
> > a PID via the fdinfo must be prepared to read `-1`.
> >
> > Despite user-space knowing that a pidfd might be stale, several kernel
> > APIs currently add another layer that checks for this. In particular,
> > SO_PEERPIDFD returns `EINVAL` if the peer-task was already reaped,
> > but returns a stale pidfd if the task is reaped immediately after the
> > respective alive-check.
> >
> > This has the unfortunate effect that user-space now has two ways to
> > check for the exact same scenario: A syscall might return
> > EINVAL/ESRCH/... *or* the pidfd might be stale, even though there is no
> > particular reason to distinguish both cases. This also propagates
> > through user-space APIs, which pass on pidfds. They must be prepared to
> > pass on `-1` *or* the pidfd, because there is no guaranteed way to get a
> > stale pidfd from the kernel.
> > Userspace must already deal with a pidfd referring to a reaped task as
> > the task may exit and get reaped at any time will there are still many
> > pidfds referring to it.
> 
> In order to allow handing out reaped pidfd SO_PEERPIDFD needs to ensure
> that PIDFD_INFO_EXIT information is available whenever a pidfd for a
> reaped task is created by PIDFD_INFO_EXIT. The uapi promises that reaped
> pidfds are only handed out if it is guaranteed that the caller sees the
> exit information:
> 
> TEST_F(pidfd_info, success_reaped)
> {
>         struct pidfd_info info = {
>                 .mask = PIDFD_INFO_CGROUPID | PIDFD_INFO_EXIT,
>         };
> 
>         /*
>          * Process has already been reaped and PIDFD_INFO_EXIT been set.
>          * Verify that we can retrieve the exit status of the process.
>          */
>         ASSERT_EQ(ioctl(self->child_pidfd4, PIDFD_GET_INFO, &info), 0);
>         ASSERT_FALSE(!!(info.mask & PIDFD_INFO_CREDS));
>         ASSERT_TRUE(!!(info.mask & PIDFD_INFO_EXIT));
>         ASSERT_TRUE(WIFEXITED(info.exit_code));
>         ASSERT_EQ(WEXITSTATUS(info.exit_code), 0);
> }
> 
> To hand out pidfds for reaped processes we thus allocate a pidfs entry
> for the relevant sk->sk_peer_pid at the time the sk->sk_peer_pid is
> stashed and drop it when the socket is destroyed. This guarantees that
> exit information will always be recorded for the sk->sk_peer_pid task
> and we can hand out pidfds for reaped processes.
> 
> Link: https://lore.kernel.org/lkml/20230807085203.819772-1-david@readahead.eu [1]
> Signed-off-by: Christian Brauner <brauner@...nel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>