David Howells
de09a9771a
CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials ...
It's possible for get_task_cred() as it currently stands to 'corrupt' a set of
credentials by incrementing their usage count after their replacement by the
task being accessed.
What happens is that get_task_cred() can race with commit_creds():
TASK_1 TASK_2 RCU_CLEANER
-->get_task_cred(TASK_2)
rcu_read_lock()
__cred = __task_cred(TASK_2)
-->commit_creds()
old_cred = TASK_2->real_cred
TASK_2->real_cred = ...
put_cred(old_cred)
call_rcu(old_cred)
[__cred->usage == 0]
get_cred(__cred)
[__cred->usage == 1]
rcu_read_unlock()
-->put_cred_rcu()
[__cred->usage == 1]
panic()
However, since a tasks credentials are generally not changed very often, we can
reasonably make use of a loop involving reading the creds pointer and using
atomic_inc_not_zero() to attempt to increment it if it hasn't already hit zero.
If successful, we can safely return the credentials in the knowledge that, even
if the task we're accessing has released them, they haven't gone to the RCU
cleanup code.
We then change task_state() in procfs to use get_task_cred() rather than
calling get_cred() on the result of __task_cred(), as that suffers from the
same problem.
Without this change, a BUG_ON in __put_cred() or in put_cred_rcu() can be
tripped when it is noticed that the usage count is not zero as it ought to be,
for example:
kernel BUG at kernel/cred.c:168!
invalid opcode: 0000 [#1 ] SMP
last sysfs file: /sys/kernel/mm/ksm/run
CPU 0
Pid: 2436, comm: master Not tainted 2.6.33.3-85.fc13.x86_64 #1 0HR330/OptiPlex
745
RIP: 0010:[<ffffffff81069881>] [<ffffffff81069881>] __put_cred+0xc/0x45
RSP: 0018:ffff88019e7e9eb8 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff880161514480 RCX: 00000000ffffffff
RDX: 00000000ffffffff RSI: ffff880140c690c0 RDI: ffff880140c690c0
RBP: ffff88019e7e9eb8 R08: 00000000000000d0 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000040 R12: ffff880140c690c0
R13: ffff88019e77aea0 R14: 00007fff336b0a5c R15: 0000000000000001
FS: 00007f12f50d97c0(0000) GS:ffff880007400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f461bc000 CR3: 00000001b26ce000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process master (pid: 2436, threadinfo ffff88019e7e8000, task ffff88019e77aea0)
Stack:
ffff88019e7e9ec8 ffffffff810698cd ffff88019e7e9ef8 ffffffff81069b45
<0> ffff880161514180 ffff880161514480 ffff880161514180 0000000000000000
<0> ffff88019e7e9f28 ffffffff8106aace 0000000000000001 0000000000000246
Call Trace:
[<ffffffff810698cd>] put_cred+0x13/0x15
[<ffffffff81069b45>] commit_creds+0x16b/0x175
[<ffffffff8106aace>] set_current_groups+0x47/0x4e
[<ffffffff8106ac89>] sys_setgroups+0xf6/0x105
[<ffffffff81009b02>] system_call_fastpath+0x16/0x1b
Code: 48 8d 71 ff e8 7e 4e 15 00 85 c0 78 0b 8b 75 ec 48 89 df e8 ef 4a 15 00
48 83 c4 18 5b c9 c3 55 8b 07 8b 07 48 89 e5 85 c0 74 04 <0f> 0b eb fe 65 48 8b
04 25 00 cc 00 00 48 3b b8 58 04 00 00 75
RIP [<ffffffff81069881>] __put_cred+0xc/0x45
RSP <ffff88019e7e9eb8>
---[ end trace df391256a100ebdd ]---
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-07-29 15:16:17 -07:00
sysrq,kdb: Use __handle_sysrq() for kdb's sysrq function
2010-07-21 19:27:07 -05:00
genirq: Deal with desc->set_type() changing desc->chip
2010-06-09 17:05:08 +02:00
suspend: Move NVS save/restore code to generic suspend functionality
2010-06-10 11:02:34 -04:00
Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-07-02 09:52:58 -07:00
perf/tracing: Fix regression of perf losing kprobe events
2010-06-10 20:56:54 -04:00
Merge branch 'next' into for-linus
2010-05-18 08:57:00 +10:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
audit: preface audit printk with audit
2010-04-05 13:19:45 -07:00
sched: Remove remaining USER_SCHED code
2010-04-02 20:12:00 +02:00
cgroups: alloc_css_id() increments hierarchy depth
2010-06-04 15:21:45 -07:00
Freezer / cgroup freezer: Update stale locking comments
2010-05-10 23:18:47 +02:00
cpumask: fix compat getaffinity
2010-05-19 11:48:18 -07:00
fix cpu_chain section mismatch...
2010-06-01 09:22:50 -07:00
cpusets: new round-robin rotor for SLAB allocations
2010-05-27 09:12:44 -07:00
CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials
2010-07-29 15:16:17 -07:00
kmemleak: Add support for NO_BOOTMEM configurations
2010-07-19 11:54:15 +01:00
elf coredump: add extended numbering support
2010-03-06 11:26:46 -08:00
sys_personality: change sys_personality() to accept "unsigned int" instead of u_long
2010-06-04 15:21:45 -07:00
proc: turn signal_struct->count into "int nr_threads"
2010-05-27 09:12:47 -07:00
Revert "cpusets: randomize node rotor used in cpuset_mem_spread_node()"
2010-05-30 09:00:03 -07:00
futex: futex_find_get_task remove credentails check
2010-06-30 15:43:44 -07:00
security: remove dead hook task_setgroups
2010-04-12 12:19:18 +10:00
hrtimer: Avoid double seqlock
2010-05-26 16:15:37 +02:00
hw_breakpoints: Fix percpu build failure
2010-05-04 08:39:36 +02:00
kdb: core for kgdb back end (2 of 2)
2010-05-20 21:04:21 -05:00
kexec: fix Oops in crash_shrink_memory()
2010-06-29 15:29:31 -07:00
call_usermodehelper: UMH_WAIT_EXEC ignores kernel_thread() failure
2010-05-27 09:12:45 -07:00
kprobes: Move enable/disable_kprobe() out from debugfs code
2010-05-08 18:08:30 +02:00
sysfs: add struct file* to bin_attr callbacks
2010-05-21 09:37:31 -07:00
cpuset: fix the problem that cpuset_mem_spread_node() returns an offline node
2010-03-24 16:31:21 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
lockdep: Add novalidate class for dev->mutex conversion
2010-05-21 09:37:30 -07:00
lockdep: No need to disable preemption in debug atomic ops
2010-05-04 05:38:16 +02:00
lockstat: Make lockstat counting per cpu
2010-04-06 00:15:37 +02:00
Move kernel/kgdb.c to kernel/debug/debug_core.c
2010-05-20 21:04:18 -05:00
dynamic debug: move ddebug_remove_module() down into free_module()
2010-07-27 14:32:06 -07:00
mutex: Fix optimistic spinning vs. BKL
2010-05-19 08:18:44 +02:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
kernel/: convert cpu notifier to return encapsulate errno value
2010-05-27 09:12:48 -07:00
panic: call console_verbose() in panic
2010-05-27 09:12:53 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2010-03-12 16:04:50 -08:00
perf: Fix signed comparison in perf_adjust_period()
2010-06-08 18:43:00 +02:00
pids: increase pid_max based on num_possible_cpus
2010-05-27 09:12:51 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
PM: PM QOS update fix
2010-05-17 00:21:03 +02:00
posix-cpu-timers: avoid "task->signal != NULL" checks
2010-05-27 09:12:46 -07:00
posix_timer: Fix error path in timer_create
2010-05-27 22:38:15 +02:00
printk,kdb: capture printk() when in kdb shell
2010-05-20 21:04:27 -05:00
numa: in-kernel profiling: use cpu_to_mem() for per cpu allocations
2010-05-27 09:12:57 -07:00
ptrace: PTRACE_GETFDPIC: fix the unsafe usage of child->mm
2010-05-27 09:12:44 -07:00
rcu: slim down rcutiny by removing rcu_scheduler_active and friends
2010-05-10 11:08:34 -07:00
rcu: remove all rcu head initializations, except on_stack initializations
2010-05-11 16:10:47 -07:00
rcu: slim down rcutiny by removing rcu_scheduler_active and friends
2010-05-10 11:08:34 -07:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-05-18 08:27:54 -07:00
rcu: remove all rcu head initializations, except on_stack initializations
2010-05-11 16:10:47 -07:00
rcu: reduce the number of spurious RCU_SOFTIRQ invocations
2010-05-10 11:08:35 -07:00
rcu: remove all rcu head initializations, except on_stack initializations
2010-05-11 16:10:47 -07:00
rcu: reduce the number of spurious RCU_SOFTIRQ invocations
2010-05-10 11:08:35 -07:00
kernel/: convert cpu notifier to return encapsulate errno value
2010-05-27 09:12:48 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
resource: shared I/O region support
2010-05-11 12:01:10 -07:00
Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-07-02 09:52:58 -07:00
blkio: fix for modular blk-cgroup build
2010-04-15 08:54:59 +02:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
proc_sched_show_task(): use get_nr_threads()
2010-05-27 09:12:47 -07:00
rcu: apply RCU protection to wake_affine()
2010-06-23 06:50:44 -07:00
sched: Remove ASYM_GRAN feature
2010-03-11 18:32:53 +01:00
sched: Cure load average vs NO_HZ woes
2010-04-23 11:02:02 +02:00
sched: Add enqueue/dequeue flags
2010-04-02 20:12:05 +02:00
exit: change zap_other_threads() to count sub-threads
2010-05-27 09:12:46 -07:00
slow-work: use get_ref wrapper instead of directly calling get_ref
2010-03-29 09:13:30 -07:00
SLOW_WORK: CONFIG_SLOW_WORK_PROC should be CONFIG_SLOW_WORK_DEBUG
2010-03-29 09:14:47 -07:00
kernel/: convert cpu notifier to return encapsulate errno value
2010-05-27 09:12:48 -07:00
kernel/: fix BUG_ON checks for cpu notifier callbacks direct call
2010-06-04 15:21:45 -07:00
softlockup: Stop spurious softlockup messages due to overflow
2010-03-21 19:30:13 +01:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
sched: Make sure timers have migrated before killing the migration_thread
2010-05-31 08:37:44 +02:00
kmod: add init function to usermodehelper
2010-05-27 09:12:44 -07:00
Add generic sys_ipc wrapper
2010-03-12 15:52:32 -08:00
pipe: change /proc/sys/fs/pipe-max-pages to byte sized interface
2010-06-03 14:54:39 +02:00
sysctl: don't use own implementation of hex_to_bin()
2010-05-25 08:07:05 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
timekeeping: Fix timezone update
2010-05-24 11:50:38 +02:00
kernel/: fix BUG_ON checks for cpu notifier callbacks direct call
2010-06-04 15:21:45 -07:00
tracing: Let tracepoints have data passed to tracepoint callbacks
2010-05-14 09:50:34 -04:00
mm: clean up mm_counter
2010-03-06 11:26:23 -08:00
sched: Remove a stale comment
2010-05-10 08:48:39 +02:00
kref: remove kref_set
2010-05-21 09:37:29 -07:00
kernel/: convert cpu notifier to return encapsulate errno value
2010-05-27 09:12:48 -07:00
de09a9771a