From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82731C4CED0 for ; Tue, 17 Sep 2019 18:30:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 54EB12067B for ; Tue, 17 Sep 2019 18:30:17 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b="MM7ej7ld" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729388AbfIQSaP (ORCPT ); Tue, 17 Sep 2019 14:30:15 -0400 Received: from mail.efficios.com ([167.114.142.138]:37486 "EHLO mail.efficios.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729139AbfIQSaM (ORCPT ); Tue, 17 Sep 2019 14:30:12 -0400 Received: from localhost (ip6-localhost [IPv6:::1]) by mail.efficios.com (Postfix) with ESMTP id D60FC1D4E05; Tue, 17 Sep 2019 14:30:10 -0400 (EDT) Received: from mail.efficios.com ([IPv6:::1]) by localhost (mail02.efficios.com [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id 8ItH3fNXLgAm; Tue, 17 Sep 2019 14:30:10 -0400 (EDT) Received: from localhost (ip6-localhost [IPv6:::1]) by mail.efficios.com (Postfix) with ESMTP id 85C461D4DEA; Tue, 17 Sep 2019 14:30:10 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.10.3 mail.efficios.com 85C461D4DEA DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficios.com; s=default; t=1568745010; bh=CqMom2GNro+69mwono2xUZ0u6FR2fWsf+zEON0FaiX8=; h=From:To:Date:Message-Id; b=MM7ej7lduoZ1Ib1mIVp4NLmVoh7Q636L2V1ByUKANcqxDln/sZ5uH9tmXH8TIdOJY p64r8E4VgeTigxfzSdFAKbNM0CntS73W/Cl2l9O/0/WaQ031bnHZYfVICmUFdaTdAz Nz0dQ5xKvHkQRwbgMVW3gfOe61Ov1xkLJn3oS0LNQy8fn/fdaMbOQfXwq9jxfwJ596 9xiXQtONeeFSvBm5MY5uGMUTLEXHxV5lVMYL4NzWRcrrh3067S9Uf0XdNlDe+TI4E6 jxy5Pls3f7VLAPvb/DVk7/l3nZgapu52JuOpvxxaoPMMvWfcgHOduJN47I2FApvife Sy0iMp97rHhEw== X-Virus-Scanned: amavisd-new at efficios.com Received: from mail.efficios.com ([IPv6:::1]) by localhost (mail02.efficios.com [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id PTBz_EuPSEcs; Tue, 17 Sep 2019 14:30:10 -0400 (EDT) Received: from localhost.localdomain (192-222-181-218.qc.cable.ebox.net [192.222.181.218]) by mail.efficios.com (Postfix) with ESMTPSA id 158891D4DD8; Tue, 17 Sep 2019 14:30:10 -0400 (EDT) From: Mathieu Desnoyers To: Thomas Gleixner Cc: linux-kernel@vger.kernel.org, Peter Zijlstra , "Paul E . McKenney" , Boqun Feng , "H . Peter Anvin" , Paul Turner , linux-api@vger.kernel.org, stable@vger.kernel.org, Mathieu Desnoyers , Dmitry Vyukov , Neel Natu Subject: [PATCH for 5.4 2/3] rseq: Fix: Unregister rseq for clone CLONE_VM Date: Tue, 17 Sep 2019 14:29:58 -0400 Message-Id: <20190917182959.16333-3-mathieu.desnoyers@efficios.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190917182959.16333-1-mathieu.desnoyers@efficios.com> References: <20190917182959.16333-1-mathieu.desnoyers@efficios.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org It has been reported by Google that rseq is not behaving properly with respect to clone when CLONE_VM is used without CLONE_THREAD. It keeps the prior thread's rseq TLS registered when the TLS of the thread has moved, so the kernel can corrupt the TLS of the parent. The approach of clearing the per task-struct rseq registration on clone with CLONE_THREAD flag is incomplete. It does not cover the use-case of clone with CLONE_VM set, but without CLONE_THREAD. Here is the rationale for unregistering rseq on clone with CLONE_VM flag set: 1) CLONE_THREAD requires CLONE_SIGHAND, which requires CLONE_VM to be set. Therefore, just checking for CLONE_VM covers all CLONE_THREAD uses. There is no point in checking for both CLONE_THREAD and CLONE_VM, 2) There is the possibility of an unlikely scenario where CLONE_SETTLS is used without CLONE_VM. In order to be an issue, it would require that the rseq TLS is in a shared memory area. I do not plan on adding CLONE_SETTLS to the set of clone flags which unregister RSEQ, because it would require that we also unregister RSEQ on set_thread_area(2) and arch_prctl(2) ARCH_SET_FS for completeness. So rather than doing a partial solution, it appears better to let user-space explicitly perform rseq unregistration across clone if needed in scenarios where CLONE_VM is not set. Signed-off-by: Mathieu Desnoyers Cc: Thomas Gleixner Cc: Peter Zijlstra (Intel) Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: "H . Peter Anvin" Cc: Paul Turner Cc: Dmitry Vyukov Cc: Neel Natu Cc: linux-api@vger.kernel.org Cc: # v4.18+ --- include/linux/sched.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 9f51932bd543..d1eab0012af1 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1919,11 +1919,11 @@ static inline void rseq_migrate(struct task_struct *t) /* * If parent process has a registered restartable sequences area, the - * child inherits. Only applies when forking a process, not a thread. + * child inherits. Unregister rseq for a clone with CLONE_VM set. */ static inline void rseq_fork(struct task_struct *t, unsigned long clone_flags) { - if (clone_flags & CLONE_THREAD) { + if (clone_flags & CLONE_VM) { t->rseq = NULL; t->rseq_sig = 0; t->rseq_event_mask = 0; -- 2.17.1