From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756311AbdELNHl (ORCPT ); Fri, 12 May 2017 09:07:41 -0400 Received: from mail-eopbgr50137.outbound.protection.outlook.com ([40.107.5.137]:55648 "EHLO EUR03-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755480AbdELNHj (ORCPT ); Fri, 12 May 2017 09:07:39 -0400 Authentication-Results: suse.com; dkim=none (message not signed) header.d=none;suse.com; dmarc=none action=none header.from=virtuozzo.com; Subject: [PATCH] pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() From: Kirill Tkhai To: , , , , , , , , , , , , Date: Fri, 12 May 2017 16:07:28 +0300 Message-ID: <149459442953.20826.15806664408144117255.stgit@localhost.localdomain> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: VI1P190CA0002.EURP190.PROD.OUTLOOK.COM (10.165.188.143) To HE1PR0801MB1340.eurprd08.prod.outlook.com (10.167.248.8) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 48a1f8ed-6562-4f6d-040c-08d49937dab3 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201703131423075)(201703031133081);SRVR:HE1PR0801MB1340; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1340;3:ctp5FD17/iL0or6umyi5kX3eqAGZ56Wlh5C1p2vdPMdBAkD9Sq/nqoECenq2p60gOJllLAD8pvEgXRhD7jPQvqug2KjOX7gGMfywRjvACLLBpgTBd79cw0/74WQFW7bome2WaF+TpcY1GYvxeSyZQTXWy9DNuiEoybpa2TrXpyH1DsFCWrwlZYE7pBsHx22a+rGtUa25cpwkhCzqqNSv4JYSU/11WA7edHaux+7Rl2zCHKIqT9+mqqYgjyHu9pkQHsS2KxPG7txtSA4pi6cONhFDoTqkkyQrqeQMRTzPyNedICj7uC9I0pc6P3pHHoI3ac9MQdTOYsppVJ6mwY+p0A==;25:S9QWAhbeRqQs3WPGLXQYbdGSEH3KVrU+LXSKI+MR/8zS8LjfE5bwPjtbtJf4mcvb/TTTJ0Olp27E5/YdwR+9sANQDb59vyajllJNkWwLnz+zZ2cK7bz/LZi5kq64VgkX0Im7XK0kRAxWGXkZdqgnCP2Gg8a/OuPsU4IoJlikKsR4RJlM3Ej977UqTwD5CHuBvmiQRGEUtIk7S/t3iiiilG7iRrHHSMxtws3Shc8hXTXZplvYW0wwQ7bq8coGaaqYOjRyTO3qxUb/EBmmGJyosZn+vgnK/XsiL34KQkAw07m732Q1nxk/q024gyAd5ZLdChYB4qgLtsSRtpkkWoue/tyqDn0U1OuaoJLdEYugIswJnyqfrf3PYpeIl+BYL1zWJ9WwPXWkR8KSnnOCbdZJgdSky5isyimy/iQb0/QliWrliriTPKiFYNFCn5EM0Cuz/5+rmxLyAqMNGxk98s5XXhLL8IUzLcajU2Zx1sExmBc= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1340;31:XDLl0a/Qm+4gMcOahGvKm0crgkQFzJBsCWN9q67jQOVU7FL9rZAA84fPFflYd42kBp+5Gx8sPZEjJDSxiOg+wyXDypQe+FAP4w3oIP5joMbUvwMiUzM+XFY2juxMNjgVDtCXFKuz06WNHaMnh2PfqRzPL7fmlUv87QJ+d6NKGHf/r12/F3rbxt2FgFL5AhXhzkxHuIB/4B4VY00/0Ax6SoW94VBG0KNILKlz8VsD7dw=;20:KWRi9Jq8IxPeAH9Y1fBhJdAE0LWafKhYYX5ZKJzel7pg6cvPrF9CwRKXG54CRbsTIy+QmIZdYPR/VvHbKk5Z3pJi0NkSOgjm8TpzH1M3Q3QSaLA7eXFtml0PY+2WwqrEGdLg/sLooqvjzUWHHyF/TkToJTpn608fZrRQaw26JZf1c8mGVMMp0LFBYL7f5uXcYp+5CYIsIeCBmheYDdNXQaWWLorV+T63xEa+xFLgYJ2JYM6i4B68h7Z/4PG2HzpmtHigWrefPEkZHfrGf5/aX5rdwjnMXCpTzmxPDfHpushMU8Sq0jmlPGEQ3o1Dy3eymbOe4LTEjhs0xj+cG0mE4RPUMl4ercqVvLFCH6+fyvdLHIhClKPI9aKqOU1bFZ0kWra/wZO8wpu1g43eryyL7/2OOzTu0Mxej37hpI1NEG4= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(104084551191319); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(10201501046)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(20161123564025)(20161123555025)(20161123562025)(6072148);SRVR:HE1PR0801MB1340;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1340; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1340;4:XWPo9RmobVA2G7znoTs307gTgmK179I3XqeESQbAWt7ufr+/0iRLfXH0THfUwCbkPQJ5vx7BS/I5jwBn+p5AjumY2IZxtNPkiQawSF7b9/nLb7jqejdpE393Kz9/vvWcVxVCJtVbCkYXcnW9rABFU04q2dccLmQpFkANzPeyiM29/4q9Y8Db7UdaQXS8HpaAPDxjDNQZlalYvJlbHd1Ya3+Af67pMr5pXmcsahTJKVf/0zs7PMvon0NHnHCbvQL3a7oEThZ/2wLop6sGpzNuBKs28RB1JBbj01k1xeY231GK48WrJM960/k57tWSZxu2XTc8gBx4UcglkyUkKkw535S44unAcTcEp4tuV95RcPXiccrQG/eWpJ7H6nv3gfYdrQ+7ZWkhjfTMRFQZ9FX2JRfZItyUfnnDYe15MNEb0+U9YSCZSGywb0X19pkqu9M6lUggxUG0zIfredBxiBfmJcS88ZZujnnw822x3VJ4qrvFg32sASC+kWV0Y7vUA459Ju+EUGMqS4M0UMdi2654MyAqm1omwuyMJRNlDiGMeE06FT4Uk4VSzWYrN70dCp3Mi72jWf18KNdtIbZGYp1n+tXzlJNtNv2ust0FeH3sal8rg7cEt2bCeveBEPaC7ACC0QUd5ftvNRLewq77RgkcRKeW/0DJDoY2OnrSg03aQKzAuCNazoq6xhqVSGxiaZsIvQSySlv6ezyCziRxES6HB5haiuoyewwT9ttqy8mfHzLRhCAZe6seCC9VNmPtq2pbLzH6YvTf4zVl9Jb3t1fcevWKDcUSJeNkUpaLwmn31w71A3RwuQt8eJ3pTRYMK6eeEOMTjIuofeWbLFvqdHqVaQ== X-Forefront-PRVS: 0305463112 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(39840400002)(39450400003)(39410400002)(39400400002)(53936002)(50466002)(8676002)(81166006)(42186005)(50986999)(3846002)(6116002)(103116003)(189998001)(9686003)(33646002)(55016002)(25786009)(83506001)(7416002)(5890100001)(6506006)(5660300001)(47776003)(23676002)(2201001)(2906002)(38730400002)(7736002)(305945005)(478600001)(6666003)(575784001)(61506002)(54356999)(230700001)(66066001)(921003)(1121003);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0801MB1340;H:localhost.localdomain;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtIRTFQUjA4MDFNQjEzNDA7MjM6L0MwTEs4QTRiQ3pBNGk4YmZaRGYyODF0?= =?utf-8?B?N0hnek9oK3JQZ3BMRHY5a1BoV2tIRDdleUwxTURuYzlVMUNOZlZiZ0VuRUc3?= =?utf-8?B?KzUyaDZBUWVaVUZrTnFBeE4yTG5mRUpOYUI0VkxMcHhUVHVFYlNUekU5a25N?= =?utf-8?B?RE9MekFpRVZmYTBhYUhPd2didm1wNVovRElWTTR5dnVkYVI4cmcwYUhNTjBn?= =?utf-8?B?SW1FTWpuc2Y3dExySEExa1NwMjJsUGRra2hnVGhsT1loODlMSDA4MFVkYmRS?= =?utf-8?B?OXJtT0pmbWxpQVRqdzJDZHpRaDdLSmRzeXhwYmNCQ09yWXNibFBKbDlJUnIw?= =?utf-8?B?MDlvZWw3eTBjRVljZUFHRDFXWmF5VkpEMU1aTis3KzVFb0MwRytqSGs5QVMw?= =?utf-8?B?bDYvV283MzRIZ2ZlcDRyc05DM3NwZTN4d3JNbFVreFFJUTBTN2V4cEtZeGRi?= =?utf-8?B?RktxWnJoTXREdURLdjduTzlQK3gvbXZRYzZHRExnblRqeFBpRFl6aytTZHpK?= =?utf-8?B?dXl2WUpqc0ZySVh4MXlFdFBNYUVJK2k5Sk1FMVNBRzhmNFB2dWVlcU8ydWwx?= =?utf-8?B?NDJvQ2M1Qnd2dGJ3ZFNaTEhnR0Y5Yy8wcVYzdmlrTTNteE02Vm4xWFZmcVNW?= =?utf-8?B?NDdsN2xXeTNFTzZaWlN3ZytxMEZkVGIrNmZOQncwMitUR3hPMU5vODd5c1Nm?= =?utf-8?B?THNsTTRna3hwNWU5Zy93b1h4VEtUQUYxQkxxYXozTFBUV01vVVNMb1NkeVhK?= =?utf-8?B?SHJKM2tzMTBiRm1BVmhZS01lSmsxZVQ1R011bGViN1hwR3FEMTZ4UGt3aHBt?= =?utf-8?B?VjJPVW5qcUVWclpHUmhBZUhZMWpqdzhuSDNuZUtEb1ZVRk9QM3FtNW9TQmJo?= =?utf-8?B?dmtkcDd5b1lLNFhDcG9vTC9QZzRrUldBWGh6V0wwMC9hWDhlcUhocUVjM1Br?= =?utf-8?B?RzJwd1M0aW9mTGJLZzZwOHhmUjF3aUN4d1NMcUhoaC9TMk9hWTN3Y0RtSTZr?= =?utf-8?B?VVNBVFpRclBwVk1qdElhVzgxN21UMWdDZkJMUFlralltV3N2Z1pmcXhGR2Z4?= =?utf-8?B?bVFNWTBhS1VxM2lhTlNEOVhWd0p2c1k3ZXFBWnQyd3hrZk1nWGZmN1FMSVNh?= =?utf-8?B?ck1nL010ZzhFeFVIb1l2TEs0NUhFakFpdG1aeHJlRUhpNlF5OHd5QUFxalJW?= =?utf-8?B?bUdDVG5zUGZ5S1EvTmIzcWc5UXdyemZJdGpMVEpqYzJUS0NpMEFlU0ZEUi9D?= =?utf-8?B?ajQwUFJOemJOOWEvVUt5RGtlYTZWT3ZMYUwvVERLYVhMeWJIK0hBYm9xTm5h?= =?utf-8?B?ajZBYWl6TnpnVHN4b0tZUVQ1NklnMTFSR1IwcXVxUmRJWWZDV1BlUWtVbitE?= =?utf-8?B?UWF3SExoT2p2YnQ4aWlFYlRQbldrelpCcnRkMm5Bb3ZLQk9jRGV0dDRTR09y?= =?utf-8?Q?QN5phVQY=3D?= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1340;6:/ttnUTfsLl6JVLxST3WJ6R9S5lczl1JE4xYtPDxLMTFcfeYzatMsuKYeHaiCmXtl+jlUedqDRL6189GD0D3qqmUjmzgOdRFwsEyntU4VooolNpNMPGkEvalszCtqvbN4hLZ3DuTlryoKNgNxfsQyzxInfDESyUGQVp+xSr3pB5S+y/EG5/DM8sO6xgtXorkCWMtbjU1IDB1z6eqt4DiPIp/O9GvmId6UNEHVvGN3P3tt/z/rBKpMdyLGjutfVcI5Wkisu1cuH0PzhrXFa2WY/E4eREyxdwgcTnYXC2rfei3Dy1MzDNO2AX/BhaXUJHOMDX0U2di2VoDXLC7AsKO6309tNfFaGzixcEQz9IVXAJq6w1DDqBznFNVK2AqF3peHA8pU46dLZJwJr2fgQLPyHQT5dbQEw1H29nbGuW2d6LH1r7e/B+aZj7tkInGBPGerr0UMiTQwXpsKDi/vbDJNV8LQnNRfkRf0hGBIy60n4KyFuZCq3X+OuVdJDXW4UKuehlh+6xq+WpcvUEzmGcQo8Q==;5:sEjCHz8l/T6PK/PAllWVfcCsigEzVboQo+iCxCbEVzjd177t9pc5glBbk+WDxyevjBL3+c9j3iVGJNADGnCu9jaUZnDzlJDn72BOX7dAlhFN0oKPgi3r61rui7k+FZ9Gd26leZSkvs4nN+u0grrFHw==;24:hR9yws091aQnOUoubs4F60wibpsZHRtWNFKSQcDzY9JzIQTIWjdfZx7Hbh6n3qnh0ynefELKlp6lwvKLf3jFJxlv4I0UNfHrhfJano73X58= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1340;7:pBrUDsYZEDScfYB0xTzJ4nKqOz0Jqv+sATYXjZ8pHr3tNP9ZUNkWoQpO7+fxfkKIHcpdF1NFo3tPp+xb/MjYYIUZObj5urbXs5hTZCwB0Fb7ktiRwM+5m5G5dFkauJIWWYmpYC+pkF4uxgvOwbTvaEZZBifF1A8maPIulGtZgHwfHYbBC5dJz/MAB4GIxFCTnyzgRGSwZHDTQWly6EGezd0ksW7ehDFuwbEIygMxsKn7h2/RPK/T3wRlMO2+rOzvDEbX6RcKY3sPzZL2GN22UG6X0H47aXKezhz4l2hjj37g1ofKwoQmdgAyKlUQrinfIseaAE9epz7Y/cioLuVJDA==;20:7G6DBRGpEdN57vjg8ZPuysZfloC5d6cwIX2tiZbz7HzlbEnii9Tiu54/gJrD8PD4Pbyr8YXg8juF2Onr4THtcj0MlFVmRbm26uzPk4Bhodi/nn0CpRYAgUvV9GiyP2yg8ydVP18FmrShAiZD8Q+Ca+M/zpghe9sGf5drR7B5pBg= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 May 2017 13:07:32.3046 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1340 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Imagine we have a pid namespace and a task from its parent's pid_ns, which made setns() to the pid namespace. The task is doing fork(), while the pid namespace's child reaper is dying. We have the race between them: Task from parent pid_ns Child reaper copy_process() .. alloc_pid() .. .. zap_pid_ns_processes() .. disable_pid_allocation() .. read_lock(&tasklist_lock) .. iterate over pids in pid_ns .. kill tasks linked to pids .. read_unlock(&tasklist_lock) write_lock_irq(&tasklist_lock); .. attach_pid(p, PIDTYPE_PID); .. .. .. So, just created task p won't receive SIGKILL signal, and the pid namespace will be in contradictory state. Only manual kill will help there, but does the userspace care about this? I suppose, the most users just inject a task into a pid namespace and wait a SIGCHLD from it. The patch fixes the problem. It moves disable_pid_allocation() into find_child_reaper() where tasklist_lock is held, and this allows to simply check for (pid_ns->nr_hashed & PIDNS_HASH_ADDING) in copy_process(). If allocation is disabled, we just return -ENOMEM like it's made for such cases in alloc_pid(). Signed-off-by: Kirill Tkhai CC: Andrew Morton CC: Ingo Molnar CC: Peter Zijlstra CC: Oleg Nesterov CC: Mike Rapoport CC: Michal Hocko CC: Andy Lutomirski CC: "Eric W. Biederman" CC: Andrei Vagin CC: Cyrill Gorcunov CC: Serge Hallyn --- kernel/exit.c | 2 ++ kernel/fork.c | 15 ++++++++++----- kernel/pid_namespace.c | 3 --- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/kernel/exit.c b/kernel/exit.c index 516acdb0e0ec..9310e69fbc5f 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -586,6 +586,8 @@ static struct task_struct *find_child_reaper(struct task_struct *father) return reaper; } + /* Don't allow any more processes into the pid namespace */ + disable_pid_allocation(pid_ns); write_unlock_irq(&tasklist_lock); if (unlikely(pid_ns == &init_pid_ns)) { panic("Attempted to kill init! exitcode=0x%08x\n", diff --git a/kernel/fork.c b/kernel/fork.c index bfd91b180778..dbafabf6c7b1 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1523,6 +1523,7 @@ static __latent_entropy struct task_struct *copy_process( unsigned long tls, int node) { + struct pid_namespace *pid_ns; int retval; struct task_struct *p; @@ -1735,8 +1736,9 @@ static __latent_entropy struct task_struct *copy_process( if (retval) goto bad_fork_cleanup_io; + pid_ns = p->nsproxy->pid_ns_for_children; if (pid != &init_struct_pid) { - pid = alloc_pid(p->nsproxy->pid_ns_for_children); + pid = alloc_pid(pid_ns); if (IS_ERR(pid)) { retval = PTR_ERR(pid); goto bad_fork_cleanup_thread; @@ -1845,10 +1847,11 @@ static __latent_entropy struct task_struct *copy_process( */ recalc_sigpending(); if (signal_pending(current)) { - spin_unlock(¤t->sighand->siglock); - write_unlock_irq(&tasklist_lock); retval = -ERESTARTNOINTR; - goto bad_fork_cancel_cgroup; + goto bad_fork_unlock_siglock; + } else if (unlikely(!(pid_ns->nr_hashed & PIDNS_HASH_ADDING))) { + retval = -ENOMEM; + goto bad_fork_unlock_siglock; } if (likely(p->pid)) { @@ -1906,7 +1909,9 @@ static __latent_entropy struct task_struct *copy_process( return p; -bad_fork_cancel_cgroup: +bad_fork_unlock_siglock: + spin_unlock(¤t->sighand->siglock); + write_unlock_irq(&tasklist_lock); cgroup_cancel_fork(p); bad_fork_free_pid: cgroup_threadgroup_change_end(current); diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index d1f3e9f558b8..aedf86a8017e 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -210,9 +210,6 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns) struct task_struct *task, *me = current; int init_pids = thread_group_leader(me) ? 1 : 2; - /* Don't allow any more processes into the pid namespace */ - disable_pid_allocation(pid_ns); - /* * Ignore SIGCHLD causing any terminated children to autoreap. * This speeds up the namespace shutdown, plus see the comment