rpms/kernel/F-11 linux-2.6-clone-fix-race-between-copy-process-and-de-thread.patch, NONE, 1.1 kernel.spec, 1.1715, 1.1716
Chuck Ebbert
cebbert at fedoraproject.org
Thu Aug 27 18:23:32 UTC 2009
- Previous message: rpms/libxcb/devel .cvsignore, 1.8, 1.9 libxcb.spec, 1.28, 1.29 sources, 1.8, 1.9 libxcb-1.1-no-pthread-stubs.patch, 1.2, NONE libxcb-1.3-to-git-e06955.patch, 1.1, NONE
- Next message: rpms/xorg-x11-drv-vmmouse/devel abi.patch, NONE, 1.1 xorg-x11-drv-vmmouse.spec, 1.29, 1.30
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: cebbert
Update of /cvs/pkgs/rpms/kernel/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv7471
Modified Files:
kernel.spec
Added Files:
linux-2.6-clone-fix-race-between-copy-process-and-de-thread.patch
Log Message:
Fix race in clone() syscall.
linux-2.6-clone-fix-race-between-copy-process-and-de-thread.patch:
fork.c | 20 +++++---------------
1 file changed, 5 insertions(+), 15 deletions(-)
--- NEW FILE linux-2.6-clone-fix-race-between-copy-process-and-de-thread.patch ---
From: Oleg Nesterov <oleg at redhat.com>
Date: Wed, 26 Aug 2009 21:29:24 +0000 (-0700)
Subject: clone(): fix race between copy_process() and de_thread()
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=4ab6c08336535f8c8e42cf45d7adeda882eff06e
clone(): fix race between copy_process() and de_thread()
Spotted by Hiroshi Shimamoto who also provided the test-case below.
copy_process() uses signal->count as a reference counter, but it is not.
This test case
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>
#include <pthread.h>
void *null_thread(void *p)
{
for (;;)
sleep(1);
return NULL;
}
void *exec_thread(void *p)
{
execl("/bin/true", "/bin/true", NULL);
return null_thread(p);
}
int main(int argc, char **argv)
{
for (;;) {
pid_t pid;
int ret, status;
pid = fork();
if (pid < 0)
break;
if (!pid) {
pthread_t tid;
pthread_create(&tid, NULL, exec_thread, NULL);
for (;;)
pthread_create(&tid, NULL, null_thread, NULL);
}
do {
ret = waitpid(pid, &status, 0);
} while (ret == -1 && errno == EINTR);
}
return 0;
}
quickly creates an unkillable task.
If copy_process(CLONE_THREAD) races with de_thread()
copy_signal()->atomic(signal->count) breaks the signal->notify_count
logic, and the execing thread can hang forever in kernel space.
Change copy_process() to increment count/live only when we know for sure
we can't fail. In this case the forked thread will take care of its
reference to signal correctly.
If copy_process() fails, check CLONE_THREAD flag. If it it set - do
nothing, the counters were not changed and current belongs to the same
thread group. If it is not set, ->signal must be released in any case
(and ->count must be == 1), the forked child is the only thread in the
thread group.
We need more cleanups here, in particular signal->count should not be used
by de_thread/__exit_signal at all. This patch only fixes the bug.
Reported-by: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
Tested-by: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
Signed-off-by: Oleg Nesterov <oleg at redhat.com>
Acked-by: Roland McGrath <roland at redhat.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
Cc: <stable at kernel.org>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---
diff --git a/kernel/fork.c b/kernel/fork.c
index 144326b..e6c04d4 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -815,11 +815,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
{
struct signal_struct *sig;
- if (clone_flags & CLONE_THREAD) {
- atomic_inc(¤t->signal->count);
- atomic_inc(¤t->signal->live);
+ if (clone_flags & CLONE_THREAD)
return 0;
- }
sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
tsk->signal = sig;
@@ -877,16 +874,6 @@ void __cleanup_signal(struct signal_struct *sig)
kmem_cache_free(signal_cachep, sig);
}
-static void cleanup_signal(struct task_struct *tsk)
-{
- struct signal_struct *sig = tsk->signal;
-
- atomic_dec(&sig->live);
-
- if (atomic_dec_and_test(&sig->count))
- __cleanup_signal(sig);
-}
-
static void copy_flags(unsigned long clone_flags, struct task_struct *p)
{
unsigned long new_flags = p->flags;
@@ -1239,6 +1226,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
}
if (clone_flags & CLONE_THREAD) {
+ atomic_inc(¤t->signal->count);
+ atomic_inc(¤t->signal->live);
p->group_leader = current->group_leader;
list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
}
@@ -1282,7 +1271,8 @@ bad_fork_cleanup_mm:
if (p->mm)
mmput(p->mm);
bad_fork_cleanup_signal:
- cleanup_signal(p);
+ if (!(clone_flags & CLONE_THREAD))
+ __cleanup_signal(p->signal);
bad_fork_cleanup_sighand:
__cleanup_sighand(p->sighand);
bad_fork_cleanup_fs:
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-11/kernel.spec,v
retrieving revision 1.1715
retrieving revision 1.1716
diff -u -p -r1.1715 -r1.1716
--- kernel.spec 27 Aug 2009 18:04:32 -0000 1.1715
+++ kernel.spec 27 Aug 2009 18:23:32 -0000 1.1716
@@ -724,6 +724,9 @@ Patch14010: linux-2.6-x86-dont-send-ipi-
Patch14020: linux-2.6-bitmap-make-ops-return-result.patch
Patch14030: linux-2.6-x86-dont-call-send-ipi-mask-with-empty-mask.patch
+# fix race in clone()
+Patch14040: linux-2.6-clone-fix-race-between-copy-process-and-de-thread.patch
+
%endif
BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1336,6 +1339,9 @@ ApplyPatch linux-2.6-x86-dont-send-ipi-t
ApplyPatch linux-2.6-bitmap-make-ops-return-result.patch
ApplyPatch linux-2.6-x86-dont-call-send-ipi-mask-with-empty-mask.patch
+# fix race in clone()
+ApplyPatch linux-2.6-clone-fix-race-between-copy-process-and-de-thread.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -1921,6 +1927,9 @@ fi
# and build.
%changelog
+* Thu Aug 27 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.30.5-37
+- Fix race in clone() syscall.
+
* Thu Aug 27 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.30.5-36
- Fix hangs on older x86 systems with 440*X chipsets.
- Previous message: rpms/libxcb/devel .cvsignore, 1.8, 1.9 libxcb.spec, 1.28, 1.29 sources, 1.8, 1.9 libxcb-1.1-no-pthread-stubs.patch, 1.2, NONE libxcb-1.3-to-git-e06955.patch, 1.1, NONE
- Next message: rpms/xorg-x11-drv-vmmouse/devel abi.patch, NONE, 1.1 xorg-x11-drv-vmmouse.spec, 1.29, 1.30
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list