From af98db5ff58f3657d68ac5f744de3c9ad69388ac Mon Sep 17 00:00:00 2001 From: Peter Zijlstra Date: Tue, 19 Apr 2022 01:27:55 +0000 Subject: [PATCH] sched: Fix yet more sched_fork() races mainline inclusion from mainline-v5.17-rc5 commit b1e8206582f9d680cff7d04828708c8b6ab32957 category: bugfix bugzilla: 186609, https://gitee.com/openeuler/kernel/issues/I532B0 CVE: NA -------------------------------- Where commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") fixed a fork race vs cgroup, it opened up a race vs syscalls by not placing the task on the runqueue before it gets exposed through the pidhash. Commit 13765de8148f ("sched/fair: Fix fault in reweight_entity") is trying to fix a single instance of this, instead fix the whole class of issues, effectively reverting this commit. Fixes: 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Reported-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) Tested-by: Tadeusz Struk Tested-by: Zhang Qiao Tested-by: Dietmar Eggemann Link: https://lkml.kernel.org/r/YgoeCbwj5mbCR0qA@hirez.programming.kicks-ass.net conflict: include/linux/sched/task.h kernel/fork.c kernel/sched/core.c Signed-off-by: Zhang Qiao Reviewed-by: Chen Hui Reviewed-by: Wang Weiyang Signed-off-by: Yongqiang Liu --- include/linux/sched/task.h | 2 +- kernel/fork.c | 12 +++++++++++- kernel/sched/core.c | 6 +++++- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h index c8b52b3ec865..1c2c099e393b 100644 --- a/include/linux/sched/task.h +++ b/include/linux/sched/task.h @@ -33,7 +33,7 @@ extern asmlinkage void schedule_tail(struct task_struct *prev); extern void init_idle(struct task_struct *idle, int cpu); extern int sched_fork(unsigned long clone_flags, struct task_struct *p); -extern void sched_post_fork(struct task_struct *p); +extern void sched_cgroup_fork(struct task_struct *p); extern void sched_dead(struct task_struct *p); void __noreturn do_task_dead(void); diff --git a/kernel/fork.c b/kernel/fork.c index 88463fd56930..231b01eba6e1 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2063,6 +2063,17 @@ static __latent_entropy struct task_struct *copy_process( if (retval) goto bad_fork_free_futex_mutex; + /* + * Now that the cgroups are pinned, re-clone the parent cgroup and put + * the new task on the correct runqueue. All this *before* the task + * becomes visible. + * + * This isn't part of ->can_fork() because while the re-cloning is + * cgroup specific, it unconditionally needs to place the task on a + * runqueue. + */ + sched_cgroup_fork(p); + /* * From this point on we must avoid any synchronous user-space * communication until we take the tasklist-lock. In particular, we do @@ -2171,7 +2182,6 @@ static __latent_entropy struct task_struct *copy_process( proc_fork_connector(p); cgroup_post_fork(p); - sched_post_fork(p); cgroup_threadgroup_change_end(current); perf_event_fork(p); diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 496ce71f93a7..b09153710259 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2357,8 +2357,9 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) return 0; } -void sched_post_fork(struct task_struct *p) +void sched_cgroup_fork(struct task_struct *p) { + unsigned long flags; /* @@ -2369,6 +2370,9 @@ void sched_post_fork(struct task_struct *p) * Silence PROVE_RCU. */ raw_spin_lock_irqsave(&p->pi_lock, flags); +#ifdef CONFIG_CGROUP_SCHED + p->sched_task_group = task_group(current); + #endif rseq_migrate(p); /* * We're setting the CPU for the first time, we don't migrate, -- GitLab