From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5BE1C43219 for ; Tue, 30 Apr 2019 08:21:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B5ACF21670 for ; Tue, 30 Apr 2019 08:21:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726505AbfD3IVd (ORCPT ); Tue, 30 Apr 2019 04:21:33 -0400 Received: from mx1.redhat.com ([209.132.183.28]:48016 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726129AbfD3IVd (ORCPT ); Tue, 30 Apr 2019 04:21:33 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E71933082B44; Tue, 30 Apr 2019 08:21:31 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-116-90.ams2.redhat.com [10.36.116.90]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 51C6A6B8E9; Tue, 30 Apr 2019 08:21:22 +0000 (UTC) From: Florian Weimer To: Linus Torvalds Cc: Jann Horn , Kevin Easton , Andy Lutomirski , Christian Brauner , Aleksa Sarai , "Enrico Weigelt\, metux IT consult" , Al Viro , David Howells , Linux API , LKML , "Serge E. Hallyn" , Arnd Bergmann , "Eric W. Biederman" , Kees Cook , Thomas Gleixner , Michael Kerrisk , Andrew Morton , Oleg Nesterov , Joel Fernandes , Daniel Colascione Subject: Re: RFC: on adding new CLONE_* flags [WAS Re: [PATCH 0/4] clone: add CLONE_PIDFD] References: <20190414201436.19502-1-christian@brauner.io> <20190415195911.z7b7miwsj67ha54y@yavin> <20190420071406.GA22257@ip-172-31-15-78> Date: Tue, 30 Apr 2019 10:21:20 +0200 In-Reply-To: (Linus Torvalds's message of "Mon, 29 Apr 2019 19:16:11 -0700") Message-ID: <87r29jaoov.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Tue, 30 Apr 2019 08:21:32 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Linus Torvalds: > Note that vfork() is "exciting" for the compiler in much the same way > "setjmp/longjmp()" is, because of the shared stack use in the child > and the parent. It is *very* easy to get this wrong and cause massive > and subtle memory corruption issues because the parent returns to > something that has been messed up by the child. Just using a wrapper around vfork is enough for that, if the return address is saved on the stack. It's surprising hard to write a test case for that, but the corruption is definitely there. > (In fact, if I recall correctly, the _reason_ we have an explicit > 'vfork()' entry point rather than using clone() with magic parameters > was that the lack of arguments meant that you didn't have to > save/restore any registers in user space, which made the whole stack > issue simpler. But it's been two decades, so my memory is bitrotting). That's an interesting point. Using a callback-style interface avoids that because you never need to restore the registers in the new subprocess. It's still appropriate to use an assembler implementation, I think, because it will be more obviously correct. > Also, particularly if you have a big address space, vfork()+execve() > can be quite a bit faster than fork()+execve(). Linux fork() is pretty > efficient, but if you have gigabytes of VM space to copy, it's going > to take time even if you do it fairly well. vfork is also more benign from a memory accounting perspective. In some environments, it's not possible to call fork from a large process because the accounting assumes (conservatively) that the new process will dirty a lot of its private memory. Thanks, Florian