From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751354AbdAWOsf (ORCPT ); Mon, 23 Jan 2017 09:48:35 -0500 Received: from mail-eopbgr40133.outbound.protection.outlook.com ([40.107.4.133]:20208 "EHLO EUR03-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750784AbdAWOsb (ORCPT ); Mon, 23 Jan 2017 09:48:31 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=ptikhomirov@virtuozzo.com; Subject: Re: [PATCH] prctl: propagate has_child_subreaper flag to every descendant To: Oleg Nesterov References: <20170119164346.4214-1-ptikhomirov@virtuozzo.com> <20170120181359.GA17205@redhat.com> <4908be49-d3c3-366d-0fd1-05249ef4ecef@virtuozzo.com> <20170123115534.GA11827@redhat.com> CC: Ingo Molnar , Peter Zijlstra , Andrew Morton , Cyrill Gorcunov , John Stultz , Thomas Gleixner , Nicolas Pitre , Michal Hocko , Stanislav Kinsburskiy , Mateusz Guzik , , Pavel Emelyanov , Konstantin Khorenko , Lennart Poettering From: Pavel Tikhomirov Message-ID: <9e63e64c-70bf-0dcc-c74d-cd2364cee1b9@virtuozzo.com> Date: Mon, 23 Jan 2017 17:30:33 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <20170123115534.GA11827@redhat.com> Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: DB6PR1001CA0023.EURPRD10.PROD.OUTLOOK.COM (10.171.79.33) To VI1PR0801MB1854.eurprd08.prod.outlook.com (10.168.68.15) X-MS-Office365-Filtering-Correlation-Id: 89876f3a-3fb6-4ea8-8397-08d4439c6720 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:VI1PR0801MB1854; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1854;3:Y3bYtRXOp7tMCt8yKByohLv/qaEU3ljPCwbu5UUvzeCTv+6gfwmEuONlOmfOHdnYdAOfuxTGP+FfCrv20/qwjJXd0ClB7/3vh+fUCHNHIWwFRGpgN2jLP8p20Ar+CV9raFRTItPXjy63Gx6jEUvJAMe6qgsVnzUijtSujPB+WzKmu540zYefM9FWcujPvoF1Q7ky48n0A8pE27woPjRNUcyC89lWGoo6iI8Ij7rEoF0IiWJjfJc881vKDWTuI/W1a3MmQeV0hM0N3nXdNVcZDA==;25:KVcSjS/4swEBprrb3HUn1d0c9nO487Ifrjac5acYlfMxX1+AV+ENjUmyKLT8/OVbwAFz19LiZyZ6jhwAJHOhHAdYl5iooXQB/L0neFQguGqQKNMUdJyQVSgYCQ/w7v1wXBtRwlxc4lRW+Oe//CYY3HNHxOVJ1X4nUfSVkTGw0Dt+Fy3mX/EDsy/B5sFZfwTRm2oAlYLcj/g06ADqBeGHwzlYr4MFRD4R9ipBwL3BM43CjgJcc125E0nncFPCXrgOcdqFIVcr6vxHMDQZPZBOizOESXFnMYWYG8l2zkIWEFUVFv4F7ctgDULBFWFRjQc0SlpCw+XasYyJRi80ol/UoCNfNRshHg60oNz7Eklly+dlD9uNZENZbwzIH+fK3gI2fUas6YanogrIdhoauao2C3tPTc2umpkw2DUB/Fi7HYgcYY05yNX40vo6DolFjokNY4fMmAC1mco6mMp7R/Q2MA== X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1854;31:6fNDmOVxjJ/EW4PLXa1j3hpM+P/KogYH5Ol/hAkXHfabNQrsJCYD37YuJ1360ln5GaZG8BdcyHw0a3Kc6fwlIYZ5q+119Nq8ZeKqqynuH60dWzizPU2GMElrfFRNNtpFDbxs/xEicHnfudGBll9ppFuNsobePvqTRuHQyZ0ppkaQtazjpbBWrAYh8rsY6dCNJHsH11NlzJgBy5bo/z5y2hURQx9BLSiJ6MfkVnQ63N4YBd0ESTM9j9ZBjQCMgHH9/o0uEdvSkipKET/3zSsRlw==;20:AhKSHNbaSlc46CmRxxTbBS5SWmT9LnmMdo7tVQWh6QIEZeketXmND2K4A4KP7JySMeyvDCCAIV23ecg++zfavNRyO5hDfZoSZNIpEgj7o3e1JkeB6M0rR8X+t9n+Sd+d3FCBIgg97tKh/nOwxodFKuZ5Gn3EOSWbDvX1559DQG7glvs1qQcK9JwaE9b7MBhF+kKF1c8fusnyMezW+Czk89+NQGgNX52gXH1peCPOBhQSLYpqNEIAHsR1IgvjHTuX X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041248)(20161123560025)(20161123562025)(20161123555025)(20161123564025)(6072148);SRVR:VI1PR0801MB1854;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1854; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1854;4:bIveWJ7vZZtvcydVbPb5nEGl/dTlyWCQXHemRn8vc8xENm5GH7fzPv2A/cl+PJPrOUm1jHkCpIj3dpRz9DgkG1Y1Q60A20Gn5z/t1CPdu+k66xuOTNqlod7hG49yhkLajo2YwnB8jvgKqLfaMYAutaG68f0nRCLTZCujwB7FWQdg71P/sMO7rgXle/bc79I4VExOihkPr/D8TfBaCy4Bv0RbxBWgi4DER9NLrWNnZ3ZHpomrP/XLU8IXSWUw4BwmDCzV3XQf8FWUYKwPPzeP3l8tz+QoGdyBSpnkefyC+H9yhYghtuKlbgoovabPhZNxHgCMAo2/g9XVTib3m6fXqdJSIoW0OZdo8oVm+US7aGrfdkg6YmbNnvC34MtqE13puB0dmnYA5xg1bZm4UU6CLOnQwyeKby18if66gBZSnhlMi8KE7AuG/ZFvPLt954E6b7O5K/GKZww6qvpGbBtWmBUh6HSSmWh+lmx5q3lY5+ITGM10e5kUF8r/Dfu67iuWhTpm1xDnxfFFUFW/aAEwIwYtoEwrmexe+kr+LFS+7YyE5A133ftj8oTrYravDZUatIqdA8bSsOZzgjOTkQpyeXl43lbKbUcQDg2KcJzkv9tBuD3HPX33Un9SX2FWuD+l X-Forefront-PRVS: 0196A226D1 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(39450400003)(377454003)(24454002)(189002)(199003)(31686004)(68736007)(53936002)(42186005)(23746002)(2906002)(4326007)(106356001)(6116002)(3846002)(81156014)(83506001)(36756003)(47776003)(92566002)(81166006)(105586002)(86362001)(64126003)(31696002)(50466002)(8676002)(65956001)(66066001)(65806001)(76176999)(50986999)(54356999)(93886004)(33646002)(101416001)(230700001)(4001350100001)(110136003)(305945005)(5660300001)(6916009)(65826007)(7416002)(229853002)(38730400001)(6486002)(54906002)(97736004)(189998001)(25786008)(2950100002)(90366009)(6666003)(7736002)(77096006);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB1854;H:[172.16.45.29];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?Windows-1252?Q?1;VI1PR0801MB1854;23:d02w0+4LOhGo6LCwZuO8sOpic1YBzGHBSsU?= =?Windows-1252?Q?MJUOpOCHGt6qNpBWibqeROLug9fokZWT82sm8MDC6jznljZZvuRQnulP?= =?Windows-1252?Q?56CUTYKdqvkgPSsS26LRtAJpIqggg0GJT9bxYJr3aQ0BBnT5lkJEOY5E?= =?Windows-1252?Q?EYI1q6Rj01M7teArztqs8JMo220EYoA0YMFgHP05g4r+VWOsIETqHmyJ?= =?Windows-1252?Q?Pho0ffr1NG/KPUHSHfBGkYdUvNNr7Tf9IptG2ij/0fIC20hQuZBzeFdY?= =?Windows-1252?Q?a3sCXEnMxQsFfROQ8t0A8nZyZ+IuMmYNnOko4pwdauJEbTw7c37kRhe3?= =?Windows-1252?Q?iz08aL0jFr72Ue7Rxgg85KTzKzY8JTtUiCnDR2JVKID1j/24cXAg5P00?= =?Windows-1252?Q?zo3NZe8hJO9zTyv3pegnnonAdqHaJZbXP3X/PJS2jkEHA0iLe4yVaoYk?= =?Windows-1252?Q?U+izxnGo6LIVZDuC+4LQRt2WTk5VyabJ9uKuJTeslF49okrmORRgJXCf?= =?Windows-1252?Q?I5tXRsA+mzyzDLNVtDthCmatKf4lcaIDR7eJCW2NKYxnb1hGPMULnxjR?= =?Windows-1252?Q?exeDn+33RZbWLLnz97uDGzs3UiBk6jA5wMdJCkCUsfjdtSay/8QAXeY4?= =?Windows-1252?Q?sDIeoDrqogfVbMIc7a4XL+JI5BEjwaBvZzrso8OhPtm8BrDs5Zi7TPA4?= =?Windows-1252?Q?e2YnxUVtwqcOoNtmXWdK02daH7SFGb/uXseR/I06dp1m4napLoYTdbi5?= =?Windows-1252?Q?I5OuUOKxXYzAJWDk7Zn5UErCSY2MraRJVwjm6H0S6SQ7IUnnclzQRDjW?= =?Windows-1252?Q?pVYIY8Yr+/KICJyGcUPe2ZuAPvy2KxMF/RrR72gwCbRuzz148FuGpj6+?= =?Windows-1252?Q?FNa0+IrhPtcDbEwJB3748e8eP0+RAnNDMGKMG9AeOWfyquMKOI5m2yl7?= =?Windows-1252?Q?VxschEQQXpLJ8yVQB8CQBBiK8mu6sgcCwbnFrCWUUTvmzpcdOcH7YX/l?= =?Windows-1252?Q?pJPOvKIlJtJY8SlubISjVrdP5T6J8hLq7AgKQxVyHyNdfMETqFtEHxVN?= =?Windows-1252?Q?EW9ZPJcRaqRjTPJfkopG4V8EsmPjgW7W8Y/Z0T/nkrd+f4+kUHam2Afp?= =?Windows-1252?Q?JAItnVHIp0XdTmi9NTW/6GHw8PryfBz3/cxo3CkVBdzTkpx1xSZCw7Of?= =?Windows-1252?Q?uoVXBE7r1lPoDOKk8UdgAY8jsQB0oxRgDQkm9e1p7/yIh32448K7dsEp?= =?Windows-1252?Q?mSL1MwN1HtYcsZ41AXOEQpl20+RtTXMUCWbktJqZUzbO4M26PxCPDoUn?= =?Windows-1252?Q?+5YDNcmv7ZLPnT0Jv03GPbqUSlNa/3MbwsJ2OOv3JiYACTfkNPOn20jn?= =?Windows-1252?Q?zUSbKhF2VguvzxYLcyr8Bblk3hqgyiputQ8WrTMIrENxFda2ntcj+CiE?= =?Windows-1252?Q?+lF/xqjm1ba2mgHJIYVdROpfAv/0gQrkN4d0zT7A3RQOPZMczuFFUMkO?= =?Windows-1252?Q?Sn8+deqftHVqIEmItDSINlzBMlnS32R488PPEBIA8lnoIU7M7Wg=3D?= =?Windows-1252?Q?=3D?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1854;6:2DV5snT/kW1CH0WL7e1XX3fBsuB856XdHkOt3mloEzqyhhqctynRC5SRvBcMELrDDxQBT/03M5MsdKSXY7oRsV7F7wrmCdUbiW6/6FYUXBDt5F95PR16vHVynvTcDXZMT01tlTyTonQI7bghdWtbbxThf+36+qP11WGByPTvsdifq3TQ2DCRZLt3S3f55Q/Dd76/llTwVYFo3dVV06j6kvDdrQ+0+7JxEeX6wwvY21EBHVc9cOfyL/9AUI2nQDKfLZevmVjT8jpp/2q/Q4rdouEq4oWxQK1QGMTz7fr1kRYP/Kk5FnQM/zJ+qYiP+8fxFcdtJ5EkURRXhqcXwnXeJuRJ6ZePHctTXZ+pgeaYXw9oPGdKvU48QGKE4ZG9Ta68c1qsRsceVtG4rq0om3pt8wcYLTvuknmlCpLSZ+BUaes=;5:DNW3keaO5mdH5X7y18CwEGIAV2MyjoDhFlrSgaQZ5K3K5ETskQbsTUitTMYpOJJgqkYVt7B9hOelaAHT8wDryFijtQE4BEWqkX6iftpxlIYmWHR8wwIQFLUXWYc0e50qb72o29bH+ETt8ecndCXLzQ==;24:H2XK8+5+aoZJ07cuu+R7NVOUyeS9OJOt0njYVRDY6WW3TAlSh3bzV13rue1dGPI7vS4JuNPqqX60rKaMs2W5kL44nHgmvLRsRImKfUiJE7c= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1854;7:fCdhd9OXu4xou2LOSGbQCjDPFkbZxUGcoNv85eVe87+1Wa/3a5bt/ClIQXXqLDUMJS5TmRe1KLDA4mNqHNqaUrUhPZTNpmnkWgrY2ktkIXM/tWOb6AUMR9ddnWRwJ75JRwyiJxUN/B++a1zzpiTFrVpqlivdPhW3qAcaxwxfaE2jU8WDeGaEgc2gvZr++Fj1ig4RWBgMSgIPq3F6LoE93U0UgXEna/WX9D2ZH6sHAf7HbG/4qcE/B6EXKmjVBHHCg/TtLLRhDsNOxrRPe5VhJnuIIrxnIHiUOrFCjzGkKD3a8BRHWk54ROEzDqNm9udy2DQsIKG9v4n3CUXXskCKh9LA8mK38X61bn/Vf37pAPeoXmQ2Gf9dMg1dtSXLzdCKe74yTV/GrPQ/oaeoAHsyBxVapxWQuezchColVpJgMdcHV+jACu0q7aalhgqq98hbiraKo6X2evOUFZX90EpWjA==;20:B3mMfFSKiHAPNZNXD48TWpm1X6rpUn74fetWDUBlY+q+wSoZCUqpCsrtB39FSC4XUcK3Y+tFmXDK3VHVCsPUob+E47puWeTyJd+k7Aonte2noANk2awFYh0X/NhNE7D4Z1q4rcWKET0y4lq9K7WtUnnLT2n4F8arObD6Goo4nd0= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jan 2017 14:30:37.1880 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1854 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Add to cc Lennart Poettering On 01/23/2017 02:55 PM, Oleg Nesterov wrote: > On 01/22, Pavel Tikhomirov wrote: >> >>> >>> Hmm. could you explain how this change helps CRIU? I mean, why >>> restorer can't do prctl(CHILD_SUBREAPER) before the first fork? >> >> Imagine we have these tree in pidns: >> >> 1: has_child_subreaper == 0 && is_child_subreaper == 0 >> |-2: has_child_subreaper == 0 && is_child_subreaper == 1 >> | |-3: has_child_subreaper == 0 && is_child_subreaper == 0 >> | | |-5: has_child_subreaper == 0 && is_child_subreaper == 0 >> | |-4: has_child_subreaper == 1 && is_child_subreaper == 0 >> | | |-6: has_child_subreaper == 1 && is_child_subreaper == 0 >> >> before c/r: If 4 dies 6 will reparent to 2, if 3 dies 5 will reparent to 1. >> after c/r: (where restorer had is_child_subreaper == 1, everybody in the >> tree will have has_child_subreaper == 1) Everybody will reparent to 2. > > This is clear, but this can only happen if 2 forks 3 and after that > sets is_child_subreaper, right? > > And if someone actually does this then your patch can break this > application, no? > > IOW. Currently CRIU can't restore the process tree with the same > has_child_subreaper bits if some process forks before > prctl(PR_SET_CHILD_SUBREAPER). It restores the tree as if prctl() > was called before the 1st fork. > > So you change the semantics of PR_SET_CHILD_SUBREAPER and now CRIU > is fine simply because you remove this feature: the sub-reaper can > no longer pre-fork the children which should reparent to the previous > reaper. > > I won't really argure, but I am not sure this is good idea... If one task uses these feature now it must be very carefull: if some our ancestor have enabled is_child_subreaper somewhere up the tree, forked our tree and after that disabled is_child_subreaper, so we already have has-flag and all children will inherit has-flag irrelevant to what is our order of fork/prctl-ing to become subreaper. And only one way to check if the task has no has_child_subreaper flag is to create some childs kill them and see to where they will reparent, but I doubt that someone is doing these now. > At least I think this should be clearly documented. Yes, I surely need to add some documentation here. Thanks for mentioning that! - Will do. > >>> You don't need this new member and descendants_lock. task_struct has >>> the ->real_parent pointer so you can work the tree without recursion. >> >> Sorry I don't get how I can walk down the tree of all descendants with help >> of ->real_parent pointer, can you please point on some example or explain a >> bit more? (I see task_is_descendant() in security/yama/yama_lsm.c but we >> will need to check it for every process, not only descendants, the latter >> can be a lot faster.) > > I'll send a patch, probably a generic helper makes sense. > > Btw task_is_descendant() looks wrong at first glance. > > Oleg. > -- Best regards, Tikhomirov Pavel Software Developer, Virtuozzo.