From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAE4BC433DB for ; Mon, 22 Feb 2021 21:31:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7444364E25 for ; Mon, 22 Feb 2021 21:31:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231941AbhBVVb5 (ORCPT ); Mon, 22 Feb 2021 16:31:57 -0500 Received: from out03.mta.xmission.com ([166.70.13.233]:43926 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231653AbhBVVbw (ORCPT ); Mon, 22 Feb 2021 16:31:52 -0500 Received: from in02.mta.xmission.com ([166.70.13.52]) by out03.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1lEInN-007196-V3; Mon, 22 Feb 2021 14:31:10 -0700 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=fess.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1lEIms-002aVG-Pz; Mon, 22 Feb 2021 14:30:44 -0700 From: ebiederm@xmission.com (Eric W. Biederman) To: "Dmitry V. Levin" Cc: "David S. Miller" , Alexey Gladkov , Gleb Fotengauer-Malinovskiy , Anatoly Pugachev , sparclinux@vger.kernel.org, linux-kernel@vger.kernel.org References: <20210217080000.GA25861@altlinux.org> <20210219225030.GA23520@altlinux.org> Date: Mon, 22 Feb 2021 15:30:22 -0600 In-Reply-To: <20210219225030.GA23520@altlinux.org> (Dmitry V. Levin's message of "Sat, 20 Feb 2021 01:50:30 +0300") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1lEIms-002aVG-Pz;;;mid=;;;hst=in02.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX18Ez1vVV4mpsDez1nJEd58yYeZls3EPhUk= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH v2] sparc: make copy_thread honor pid namespaces X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org "Dmitry V. Levin" writes: > On sparc, fork and clone syscalls have an unusual semantics of > returning the pid of the parent process to the child process. > > Apparently, the implementation did not honor pid namespaces at all, > so the child used to get the pid of its parent in the init namespace. > > Fortunately, most users of these syscalls are not affected by this bug > because they use another register to distinguish the parent process > from its child, and the pid of the parent process is often discarded. > > Reproducer: > > $ gcc -Wall -O2 -xc - <<'EOF' > #define _GNU_SOURCE > #include > #include > #include > #include > #include > #include > #include > #include > #include > static void test_fork(void) > { > int pid = syscall(__NR_fork); > if (pid < 0) > err(1, "fork"); > fprintf(stderr, "current: %d, parent: %d, fork returned: %d\n", > getpid(), getppid(), pid); > int status; > if (wait(&status) < 0) { > if (errno == ECHILD) > _exit(0); > err(1, "wait"); > } > if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) > errx(1, "wait: %#x", status); > } > int main(void) > { > test_fork(); > if (unshare(CLONE_NEWPID | CLONE_NEWUSER) < 0) > err(1, "unshare"); > test_fork(); > return 0; > } > EOF > $ sh -c ./a.out > current: 10001, parent: 10000, fork returned: 10002 > current: 10002, parent: 10001, fork returned: 10001 > current: 10001, parent: 10000, fork returned: 10003 > current: 1, parent: 0, fork returned: 10001 > > This bug was found by strace test suite. > > Cc: Eric W. Biederman > Cc: stable@vger.kernel.org > Signed-off-by: Dmitry V. Levin > --- > > v2: Replaced task_active_pid_ns(p) with current->nsproxy->pid_ns_for_children > as suggested by Eric. I can't test this either. But from just reading through the code earlier. Acked-by: "Eric W. Biederman" > arch/sparc/kernel/process_32.c | 3 ++- > arch/sparc/kernel/process_64.c | 3 ++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c > index a02363735915..3be653e40204 100644 > --- a/arch/sparc/kernel/process_32.c > +++ b/arch/sparc/kernel/process_32.c > @@ -368,7 +368,8 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, unsigned long arg, > #endif > > /* Set the return value for the child. */ > - childregs->u_regs[UREG_I0] = current->pid; > + childregs->u_regs[UREG_I0] = > + task_pid_nr_ns(current, current->nsproxy->pid_ns_for_children); > childregs->u_regs[UREG_I1] = 1; > > /* Set the return value for the parent. */ > diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c > index 6f8c7822fc06..f53ef5cff46a 100644 > --- a/arch/sparc/kernel/process_64.c > +++ b/arch/sparc/kernel/process_64.c > @@ -629,7 +629,8 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, unsigned long arg, > t->utraps[0]++; > > /* Set the return value for the child. */ > - t->kregs->u_regs[UREG_I0] = current->pid; > + t->kregs->u_regs[UREG_I0] = > + task_pid_nr_ns(current, current->nsproxy->pid_ns_for_children); > t->kregs->u_regs[UREG_I1] = 1; > > /* Set the second return value for the parent. */