There is a small race between copy_process() and sched_fork()
where child->sched_task_group point to an already freed pointer.
parent doing fork() | someone moving the parent
to another cgroup
-------------------------------+-------------------------------
copy_process()
+ dup_task_struct()<1>
parent move to another cgroup,
and free the old cgroup. <2>
+ sched_fork()
+ __set_task_cpu()<3>
+ task_fork_fair()
+ sched_slice()<4>
In the worst case, this bug can lead to "use-after-free" and
cause panic as shown above,
(1)parent copy its sched_task_group to child at <1>;
(2)someone move the parent to another cgroup and free the old
cgroup at <2>;
(3)the sched_task_group and cfs_rq that belong to the old cgroup
will be accessed at <3> and <4>, which cause a panic:
[89249.732198] BUG: unable to handle kernel NULL pointer
dereference at 0000000000000000
[89249.732701] PGD 8000001fa0a86067 P4D 8000001fa0a86067 PUD
2029955067 PMD 0
[89249.733005] Oops: 0000 [#1] SMP PTI
[89249.733288] CPU: 7 PID: 648398 Comm: ebizzy Kdump: loaded
Tainted: G OE --------- - - 4.18.0.x86_64+ #1
[89249.734318] RIP: 0010:sched_slice+0x84/0xc0
....
[89249.737910] Call Trace:
[89249.738181] task_fork_fair+0x81/0x120
[89249.738457] sched_fork+0x132/0x240
[89249.738732] copy_process.part.5+0x675/0x20e0
[89249.739010] ? __handle_mm_fault+0x63f/0x690
[89249.739286] _do_fork+0xcd/0x3b0
[89249.739558] do_syscall_64+0x5d/0x1d0
[89249.739830] entry_SYSCALL_64_after_hwframe+0x65/0xca
[89249.740107] RIP: 0033:0x7f04418cd7e1
When a new process is forked, cgroup_post_fork() associates it
with the cgroup of its parent. Therefore this commit move the
__set_task_cpu() and task_fork() that access some cgroup-related
fields(sched_task_group and cfs_rq) to sched_post_fork() and
call sched_post_fork() after cgroup_post_fork().
Fixes: 8323f26ce342 ("sched: Fix race in task_group")
Signed-off-by: Zhang Qiao <[email protected]>
---
kernel/fork.c | 2 +-
kernel/sched/core.c | 33 +++++++++++++--------------------
2 files changed, 14 insertions(+), 21 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index bc94b2cc5995..a4acd87f00f9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2330,8 +2330,8 @@ static __latent_entropy struct task_struct *copy_process(
write_unlock_irq(&tasklist_lock);
proc_fork_connector(p);
- sched_post_fork(p);
cgroup_post_fork(p, args);
+ sched_post_fork(p);
perf_event_fork(p);
trace_task_newtask(p, clone_flags);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 20ffcc044134..041f21e8b266 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4069,8 +4069,6 @@ int sysctl_schedstats(struct ctl_table *table, int write, void *buffer,
*/
int sched_fork(unsigned long clone_flags, struct task_struct *p)
{
- unsigned long flags;
-
__sched_fork(clone_flags, p);
/*
* We mark the process as NEW here. This guarantees that
@@ -4116,24 +4114,6 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
init_entity_runnable_average(&p->se);
- /*
- * The child is not yet in the pid-hash so no cgroup attach races,
- * and the cgroup is pinned to this child due to cgroup_fork()
- * is ran before sched_fork().
- *
- * Silence PROVE_RCU.
- */
- raw_spin_lock_irqsave(&p->pi_lock, flags);
- rseq_migrate(p);
- /*
- * We're setting the CPU for the first time, we don't migrate,
- * so use __set_task_cpu().
- */
- __set_task_cpu(p, smp_processor_id());
- if (p->sched_class->task_fork)
- p->sched_class->task_fork(p);
- raw_spin_unlock_irqrestore(&p->pi_lock, flags);
-
#ifdef CONFIG_SCHED_INFO
if (likely(sched_info_on()))
memset(&p->sched_info, 0, sizeof(p->sched_info));
@@ -4151,6 +4131,19 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
void sched_post_fork(struct task_struct *p)
{
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&p->pi_lock, flags);
+ rseq_migrate(p);
+ /*
+ * We're setting the CPU for the first time, we don't migrate,
+ * so use __set_task_cpu().
+ */
+ __set_task_cpu(p, smp_processor_id());
+ if (p->sched_class->task_fork)
+ p->sched_class->task_fork(p);
+ raw_spin_unlock_irqrestore(&p->pi_lock, flags);
+
uclamp_post_fork(p);
}
--
2.17.1
On 2021/8/26 19:26, Zhang Qiao wrote:
> There is a small race between copy_process() and sched_fork()
> where child->sched_task_group point to an already freed pointer.
>
> parent doing fork() | someone moving the parent
> to another cgroup
> -------------------------------+-------------------------------
> copy_process()
> + dup_task_struct()<1>
> parent move to another cgroup,
> and free the old cgroup. <2>
> + sched_fork()
> + __set_task_cpu()<3>
> + task_fork_fair()
> + sched_slice()<4>
>
> In the worst case, this bug can lead to "use-after-free" and
> cause panic as shown above,
> (1)parent copy its sched_task_group to child at <1>;
> (2)someone move the parent to another cgroup and free the old
> cgroup at <2>;
> (3)the sched_task_group and cfs_rq that belong to the old cgroup
> will be accessed at <3> and <4>, which cause a panic:
>
> [89249.732198] BUG: unable to handle kernel NULL pointer
> dereference at 0000000000000000
> [89249.732701] PGD 8000001fa0a86067 P4D 8000001fa0a86067 PUD
> 2029955067 PMD 0
> [89249.733005] Oops: 0000 [#1] SMP PTI
> [89249.733288] CPU: 7 PID: 648398 Comm: ebizzy Kdump: loaded
> Tainted: G OE --------- - - 4.18.0.x86_64+ #1
> [89249.734318] RIP: 0010:sched_slice+0x84/0xc0
> ....
> [89249.737910] Call Trace:
> [89249.738181] task_fork_fair+0x81/0x120
> [89249.738457] sched_fork+0x132/0x240
> [89249.738732] copy_process.part.5+0x675/0x20e0
> [89249.739010] ? __handle_mm_fault+0x63f/0x690
> [89249.739286] _do_fork+0xcd/0x3b0
> [89249.739558] do_syscall_64+0x5d/0x1d0
> [89249.739830] entry_SYSCALL_64_after_hwframe+0x65/0xca
> [89249.740107] RIP: 0033:0x7f04418cd7e1
>
> When a new process is forked, cgroup_post_fork() associates it
> with the cgroup of its parent. Therefore this commit move the
> __set_task_cpu() and task_fork() that access some cgroup-related
> fields(sched_task_group and cfs_rq) to sched_post_fork() and
> call sched_post_fork() after cgroup_post_fork().
>
> Fixes: 8323f26ce342 ("sched: Fix race in task_group")
> Signed-off-by: Zhang Qiao <[email protected]>
hello, a gentle ping to confirm whether this gets a review or not.
thanks,
Qiao.
> ---
> kernel/fork.c | 2 +-
> kernel/sched/core.c | 33 +++++++++++++--------------------
> 2 files changed, 14 insertions(+), 21 deletions(-)
>
> diff --git a/kernel/fork.c b/kernel/fork.c
> index bc94b2cc5995..a4acd87f00f9 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -2330,8 +2330,8 @@ static __latent_entropy struct task_struct *copy_process(
> write_unlock_irq(&tasklist_lock);
>
> proc_fork_connector(p);
> - sched_post_fork(p);
> cgroup_post_fork(p, args);
> + sched_post_fork(p);
> perf_event_fork(p);
>
> trace_task_newtask(p, clone_flags);
> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> index 20ffcc044134..041f21e8b266 100644
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c
> @@ -4069,8 +4069,6 @@ int sysctl_schedstats(struct ctl_table *table, int write, void *buffer,
> */
> int sched_fork(unsigned long clone_flags, struct task_struct *p)
> {
> - unsigned long flags;
> -
> __sched_fork(clone_flags, p);
> /*
> * We mark the process as NEW here. This guarantees that
> @@ -4116,24 +4114,6 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
>
> init_entity_runnable_average(&p->se);
>
> - /*
> - * The child is not yet in the pid-hash so no cgroup attach races,
> - * and the cgroup is pinned to this child due to cgroup_fork()
> - * is ran before sched_fork().
> - *
> - * Silence PROVE_RCU.
> - */
> - raw_spin_lock_irqsave(&p->pi_lock, flags);
> - rseq_migrate(p);
> - /*
> - * We're setting the CPU for the first time, we don't migrate,
> - * so use __set_task_cpu().
> - */
> - __set_task_cpu(p, smp_processor_id());
> - if (p->sched_class->task_fork)
> - p->sched_class->task_fork(p);
> - raw_spin_unlock_irqrestore(&p->pi_lock, flags);
> -
> #ifdef CONFIG_SCHED_INFO
> if (likely(sched_info_on()))
> memset(&p->sched_info, 0, sizeof(p->sched_info));
> @@ -4151,6 +4131,19 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
>
> void sched_post_fork(struct task_struct *p)
> {
> + unsigned long flags;
> +
> + raw_spin_lock_irqsave(&p->pi_lock, flags);
> + rseq_migrate(p);
> + /*
> + * We're setting the CPU for the first time, we don't migrate,
> + * so use __set_task_cpu().
> + */
> + __set_task_cpu(p, smp_processor_id());
> + if (p->sched_class->task_fork)
> + p->sched_class->task_fork(p);
> + raw_spin_unlock_irqrestore(&p->pi_lock, flags);
> +
> uclamp_post_fork(p);
> }
>
>
On Thu, Aug 26, 2021 at 07:26:35PM +0800, Zhang Qiao wrote:
> There is a small race between copy_process() and sched_fork()
> where child->sched_task_group point to an already freed pointer.
>
> parent doing fork() | someone moving the parent
> to another cgroup
> -------------------------------+-------------------------------
> copy_process()
> + dup_task_struct()<1>
> parent move to another cgroup,
> and free the old cgroup. <2>
> + sched_fork()
> + __set_task_cpu()<3>
> + task_fork_fair()
> + sched_slice()<4>
>
> In the worst case, this bug can lead to "use-after-free" and
> cause panic as shown above,
> (1)parent copy its sched_task_group to child at <1>;
> (2)someone move the parent to another cgroup and free the old
> cgroup at <2>;
> (3)the sched_task_group and cfs_rq that belong to the old cgroup
> will be accessed at <3> and <4>, which cause a panic:
>
> [89249.732198] BUG: unable to handle kernel NULL pointer
> dereference at 0000000000000000
> [89249.732701] PGD 8000001fa0a86067 P4D 8000001fa0a86067 PUD
> 2029955067 PMD 0
> [89249.733005] Oops: 0000 [#1] SMP PTI
> [89249.733288] CPU: 7 PID: 648398 Comm: ebizzy Kdump: loaded
> Tainted: G OE --------- - - 4.18.0.x86_64+ #1
> [89249.734318] RIP: 0010:sched_slice+0x84/0xc0
> ....
> [89249.737910] Call Trace:
> [89249.738181] task_fork_fair+0x81/0x120
> [89249.738457] sched_fork+0x132/0x240
> [89249.738732] copy_process.part.5+0x675/0x20e0
> [89249.739010] ? __handle_mm_fault+0x63f/0x690
> [89249.739286] _do_fork+0xcd/0x3b0
> [89249.739558] do_syscall_64+0x5d/0x1d0
> [89249.739830] entry_SYSCALL_64_after_hwframe+0x65/0xca
> [89249.740107] RIP: 0033:0x7f04418cd7e1
>
> When a new process is forked, cgroup_post_fork() associates it
> with the cgroup of its parent. Therefore this commit move the
> __set_task_cpu() and task_fork() that access some cgroup-related
> fields(sched_task_group and cfs_rq) to sched_post_fork() and
> call sched_post_fork() after cgroup_post_fork().
>
> Fixes: 8323f26ce342 ("sched: Fix race in task_group")
> Signed-off-by: Zhang Qiao <[email protected]>
Hmm, I think you're right. Did something recently chagne in cgroup land
to make this more visible? This code hasn't changed in like 9 years.
Hello,
On Mon, Aug 30, 2021 at 04:39:54PM +0200, Peter Zijlstra wrote:
> > When a new process is forked, cgroup_post_fork() associates it
> > with the cgroup of its parent. Therefore this commit move the
> > __set_task_cpu() and task_fork() that access some cgroup-related
> > fields(sched_task_group and cfs_rq) to sched_post_fork() and
> > call sched_post_fork() after cgroup_post_fork().
I think this would allow cgroup migrations to take place before
sched_post_fork() is run, which likely will break stuff. The right
thing to do likely is taking sched_task_group (and whatever other
fields) after cgroup_can_fork(), which fixates the cgroup memberships,
is run. For other controllers, operations like this would be performed
from cgroup_subsys->fork() callback but it's tricky for sched due to
autogroup.
> > Fixes: 8323f26ce342 ("sched: Fix race in task_group")
> > Signed-off-by: Zhang Qiao <[email protected]>
>
> Hmm, I think you're right. Did something recently chagne in cgroup land
> to make this more visible? This code hasn't changed in like 9 years.
I can't think of any remotely recent change either. I guess ppl just
don't try to migrate the parent while fork is in progress.
Thanks.
--
tejun
hi, thanks for your reviews.
On 2021/8/31 1:32, Tejun Heo wrote:
> Hello,
>
> On Mon, Aug 30, 2021 at 04:39:54PM +0200, Peter Zijlstra wrote:
>>> When a new process is forked, cgroup_post_fork() associates it
>>> with the cgroup of its parent. Therefore this commit move the
>>> __set_task_cpu() and task_fork() that access some cgroup-related
>>> fields(sched_task_group and cfs_rq) to sched_post_fork() and
>>> call sched_post_fork() after cgroup_post_fork().
>
> I think this would allow cgroup migrations to take place before
> sched_post_fork() is run, which likely will break stuff. The right
> thing to do likely is taking sched_task_group (and whatever other
> fields) after cgroup_can_fork(), which fixates the cgroup memberships,
But it still seems possible that it accessed an invalid sched_task_group?
because the child process does not update its sched_task_group util
cgroup_post_fork().
> is run. For other controllers, operations like this would be performed
> from cgroup_subsys->fork() callback but it's tricky for sched due to
> autogroup.
>
>>> Fixes: 8323f26ce342 ("sched: Fix race in task_group")
>>> Signed-off-by: Zhang Qiao <[email protected]>
>>
>> Hmm, I think you're right. Did something recently chagne in cgroup land
>> to make this more visible? This code hasn't changed in like 9 years.
I think this problem has always existed. I've reproduced it in multiple versions,
including 3.10 and 5.14-rc3.
>
> I can't think of any remotely recent change either. I guess ppl just
> don't try to migrate the parent while fork is in progress.
>
> Thanks.
>
thandks.
Hello,
On Tue, Aug 31, 2021 at 03:58:42PM +0800, Zhang Qiao wrote:
> > I think this would allow cgroup migrations to take place before
> > sched_post_fork() is run, which likely will break stuff. The right
> > thing to do likely is taking sched_task_group (and whatever other
> > fields) after cgroup_can_fork(), which fixates the cgroup memberships,
>
> But it still seems possible that it accessed an invalid sched_task_group?
> because the child process does not update its sched_task_group util
> cgroup_post_fork().
Between cgroup_can_fork() and cgroup_post_fork(), the cgroup membership and
thus sched_task_group can't change, so if the child sets it to the parent's
inbetween, the sched_task_group can't go away.
Thanks.
--
tejun
hello,tejun.
?? 2021/9/1 6:59, Tejun Heo д??:
> Hello,
>
> On Tue, Aug 31, 2021 at 03:58:42PM +0800, Zhang Qiao wrote:
>>> I think this would allow cgroup migrations to take place before
>>> sched_post_fork() is run, which likely will break stuff. The right
cgroup migrations? Do you mean child process set its cgroups at
cgroup_subsys->fork()?
>>> thing to do likely is taking sched_task_group (and whatever other
>>> fields) after cgroup_can_fork(), which fixates the cgroup memberships,
>>
>> But it still seems possible that it accessed an invalid sched_task_group?
>> because the child process does not update its sched_task_group util
>> cgroup_post_fork().
>
> Between cgroup_can_fork() and cgroup_post_fork(), the cgroup membership and
> thus sched_task_group can't change, so if the child sets it to the parent's
> inbetween, the sched_task_group can't go away.
so the child just need to update its sched_task_group after cgroup_can_fork(),
then call sched_fork(), is it right?
thanks.
--
Qiao Zhang.
>
> Thanks.
>
Hello,
On Wed, Sep 01, 2021 at 03:43:00PM +0800, Zhang Qiao wrote:
> 在 2021/9/1 6:59, Tejun Heo 写道:
> > On Tue, Aug 31, 2021 at 03:58:42PM +0800, Zhang Qiao wrote:
> >>> I think this would allow cgroup migrations to take place before
> >>> sched_post_fork() is run, which likely will break stuff. The right
>
> cgroup migrations? Do you mean child process set its cgroups at
> cgroup_subsys->fork()?
As soon as cgroup_post_fork() is complete, userspace can try moving the
process to a different cgroup which can get confusing for sched_post_fork.
> > Between cgroup_can_fork() and cgroup_post_fork(), the cgroup membership and
> > thus sched_task_group can't change, so if the child sets it to the parent's
> > inbetween, the sched_task_group can't go away.
>
> so the child just need to update its sched_task_group after cgroup_can_fork(),
> then call sched_fork(), is it right?
Yeah, the bug here is that a field which is dependent on cgroup membership
is being read before the cgroup membership is fixated.
Thanks.
--
tejun
在 2021/9/2 0:45, Tejun Heo 写道:
> Hello,
>
> On Wed, Sep 01, 2021 at 03:43:00PM +0800, Zhang Qiao wrote:
>> 在 2021/9/1 6:59, Tejun Heo 写道:
>>> On Tue, Aug 31, 2021 at 03:58:42PM +0800, Zhang Qiao wrote:
>>>>> I think this would allow cgroup migrations to take place before
>>>>> sched_post_fork() is run, which likely will break stuff. The right
>>
>> cgroup migrations? Do you mean child process set its cgroups at
>> cgroup_subsys->fork()?
>
> As soon as cgroup_post_fork() is complete, userspace can try moving the
> process to a different cgroup which can get confusing for sched_post_fork.
hello,tejun
I checked the code again.
I don't quite understand what you said, if the child be moved between
cgroup_post_fork() and sched_post_sched(), what problems might it cause?
Does the child process will use the old sched_task_group at sched_post_fork()-->__set_task_cpu()?
Or there are other problems, Can you talk in more detail?
thanks!
---
Qiao Zhang
>
>>> Between cgroup_can_fork() and cgroup_post_fork(), the cgroup membership and
>>> thus sched_task_group can't change, so if the child sets it to the parent's
>>> inbetween, the sched_task_group can't go away.
>>
>> so the child just need to update its sched_task_group after cgroup_can_fork(),
>> then call sched_fork(), is it right?
>
> Yeah, the bug here is that a field which is dependent on cgroup membership
> is being read before the cgroup membership is fixated.
>
> Thanks.
>
Hello,
On Thu, Sep 02, 2021 at 03:42:15PM +0800, Zhang Qiao wrote:
> I checked the code again.
> I don't quite understand what you said, if the child be moved between
> cgroup_post_fork() and sched_post_sched(), what problems might it cause?
cgroup_post_fork() is where the child's creation is committed from cgroup's
POV, so it'd be migrating cgroups before the initial creation is finished.
From glancing, looks like it'll break css_set task counts to begin with.
This violates the basic assumptions and can cause critical failures in
subtle ways. The would replace one subtle race with a possibly worse one.
Thanks.
--
tejun
On 2021/9/8 1:01, Tejun Heo wrote:
> Hello,
>
> On Thu, Sep 02, 2021 at 03:42:15PM +0800, Zhang Qiao wrote:
>> I checked the code again.
>> I don't quite understand what you said, if the child be moved between
>> cgroup_post_fork() and sched_post_sched(), what problems might it cause?
>
> cgroup_post_fork() is where the child's creation is committed from cgroup's
> POV, so it'd be migrating cgroups before the initial creation is finished.
>>From glancing, looks like it'll break css_set task counts to begin with.
> This violates the basic assumptions and can cause critical failures in
> subtle ways. The would replace one subtle race with a possibly worse one.
Hello,
I will update this patch by following the steps below:
1)rename cgroup_subsys->fork() to cgroup_subsys->post_fork();
2)add cgroup_subsys->fork() and the cpu_cgroup_fork() callback like this:
void cpu_cgroup_fork(struct task_struct *task) {
....
p->sched_task_group = task_group(current);
__set_task_cpu(p, smp_processor_id());
if (p->sched_class->task_fork)
p->sched_class->task_fork(p);
....
3)call cgroup_subsys->fork() after cgroup_can_fork().
Do you have any suggestion?
thanks.
Zhang Qiao
>
> Thanks.
>
Hello,
On Wed, Sep 08, 2021 at 07:32:06PM +0800, Zhang Qiao wrote:
> I will update this patch by following the steps below:
> 1)rename cgroup_subsys->fork() to cgroup_subsys->post_fork();
> 2)add cgroup_subsys->fork() and the cpu_cgroup_fork() callback like this:
>
> void cpu_cgroup_fork(struct task_struct *task) {
> ....
> p->sched_task_group = task_group(current);
> __set_task_cpu(p, smp_processor_id());
> if (p->sched_class->task_fork)
> p->sched_class->task_fork(p);
> ....
>
>
> 3)call cgroup_subsys->fork() after cgroup_can_fork().
>
> Do you have any suggestion?
I'm not following why it needs to shuffle the callbacks. Can't you just
relocate the fectching of task_group after can_fork?
Thanks.
--
tejun
?? 2021/9/9 0:29, Tejun Heo д??:
> Hello,
>
> On Wed, Sep 08, 2021 at 07:32:06PM +0800, Zhang Qiao wrote:
>> I will update this patch by following the steps below:
>> 1)rename cgroup_subsys->fork() to cgroup_subsys->post_fork();
>> 2)add cgroup_subsys->fork() and the cpu_cgroup_fork() callback like this:
>>
>> void cpu_cgroup_fork(struct task_struct *task) {
>> ....
>> p->sched_task_group = task_group(current);
>> __set_task_cpu(p, smp_processor_id());
>> if (p->sched_class->task_fork)
>> p->sched_class->task_fork(p);
>> ....
>>
>>
>> 3)call cgroup_subsys->fork() after cgroup_can_fork().
>>
>> Do you have any suggestion?
>
> I'm not following why it needs to shuffle the callbacks. Can't you just
Just to provide a placeholder to call task_fork(). But thought about it,
there are indeed some problems with this modification.
Thanks.
Zhang Qiao
> relocate the fectching of task_group after can_fork?>
> Thanks.
>