Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp3790245ybi; Mon, 29 Jul 2019 12:40:32 -0700 (PDT) X-Google-Smtp-Source: APXvYqzhJ5sqUob75l3GobqC4V5QfJZWX9W1SVO+2NQNQD4SEP1MuTVicHE5M8DAPtJyro2V2LN9 X-Received: by 2002:a17:902:7043:: with SMTP id h3mr84550460plt.10.1564429231987; Mon, 29 Jul 2019 12:40:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564429231; cv=none; d=google.com; s=arc-20160816; b=KKZ6jluYBJ2zhT4fhVP6kIaTmbVXR6eH+0YmbTVLRprE+884PRQ+/Uc2LqRzjAkHSj mM+rbUDzwBBhMKsnm3Gsee52R3Ti8NJiGuZOT5adpKLpIA6LZ5ZX3yCgELO6lcufbhpw IBS0bltQFm9ofAtZBntj3NzpiXgOj+2P4T8qz1qRdgRbYKuX9T0lRvIWP1G9qT4ZcElz T9pnvra8+H8MPr6Rb0nyTvOCkoFDJfawUObk79RaFr6NnuA6Ti2C7x2Fi3y2r4dCj13D kf0Zza34VrwSqMVfWKGnWx6Tkv9Sd4BqTSdcOUc100PwvzuzzThvQKTcQ9Y0jso4ov1W KRjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Uwhe0GQgusJYKMdOdl2qvOAgig4rREtvD2r3gt584hE=; b=JQu8BNbIyAyvhYQp1wLQoiONlY9HcHgBVCiitbnO+DV1Es34i7Z1S2M5/DGTnMc/38 6jfGzRHLEwfw0vxtCpjjUdW6L2Z7wjKnZejvAEXmxoxCu8dZ4WhFDIeiyInIrs0qa9+3 hxmqK+Y/8fHjxX3uheZCfjZVY9LGxvaBS3t+3JA6YSWi9bKiGziHwlUUUdWUjct0Y5I4 aDmKHyFYF5P1hhyvIErk1Xrxlikfyf8D11sAXGq7GPybhLdIaoFS+LGlj+Rlehg5sy2I sBMLH3tHL2onuHk5MTT0sqwk38voAoY+G6/9PRpRZcbSnU5drgff5WuMI4oFaYYahMyh U0CA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=WS76KBOQ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j27si17884883pgj.571.2019.07.29.12.40.16; Mon, 29 Jul 2019 12:40:31 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=WS76KBOQ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388501AbfG2Ti4 (ORCPT + 99 others); Mon, 29 Jul 2019 15:38:56 -0400 Received: from mail.kernel.org ([198.145.29.99]:53754 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727247AbfG2Tit (ORCPT ); Mon, 29 Jul 2019 15:38:49 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0A380206DD; Mon, 29 Jul 2019 19:38:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564429128; bh=ZK3hZGNoAg4qgV9UlJLIID+6v6ypA+jGWdm0izOQr88=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WS76KBOQExUzQfp/J++LjYoHMfj1PMQ19zS4OD4Fbml7i+0qp+STDI/Ctoiiwn/b6 WPYd3T272b+FI+fte2i5B4c+HNYua64gOXb7iYEf4eiYBrNyK52KneXGC+QrPjQ5Uh qwMfOBTtbK22EjEvdwKSOgqQrKb7hQ5t5SYU83JE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Peter Zijlstra (Intel)" , Eric Dumazet , "Paul E. McKenney" , Oleg Nesterov , Jan Glauber , Jiri Kosina , Jayachandran Chandrasekharan Nair , Greg KH , Kees Cook , David Howells , Miklos Szeredi , Al Viro , Linus Torvalds Subject: [PATCH 4.14 293/293] access: avoid the RCU grace period for the temporary subjective credentials Date: Mon, 29 Jul 2019 21:23:04 +0200 Message-Id: <20190729190846.684672650@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190729190820.321094988@linuxfoundation.org> References: <20190729190820.321094988@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus Torvalds commit d7852fbd0f0423937fa287a598bfde188bb68c22 upstream. It turns out that 'access()' (and 'faccessat()') can cause a lot of RCU work because it installs a temporary credential that gets allocated and freed for each system call. The allocation and freeing overhead is mostly benign, but because credentials can be accessed under the RCU read lock, the freeing involves a RCU grace period. Which is not a huge deal normally, but if you have a lot of access() calls, this causes a fair amount of seconday damage: instead of having a nice alloc/free patterns that hits in hot per-CPU slab caches, you have all those delayed free's, and on big machines with hundreds of cores, the RCU overhead can end up being enormous. But it turns out that all of this is entirely unnecessary. Exactly because access() only installs the credential as the thread-local subjective credential, the temporary cred pointer doesn't actually need to be RCU free'd at all. Once we're done using it, we can just free it synchronously and avoid all the RCU overhead. So add a 'non_rcu' flag to 'struct cred', which can be set by users that know they only use it in non-RCU context (there are other potential users for this). We can make it a union with the rcu freeing list head that we need for the RCU case, so this doesn't need any extra storage. Note that this also makes 'get_current_cred()' clear the new non_rcu flag, in case we have filesystems that take a long-term reference to the cred and then expect the RCU delayed freeing afterwards. It's not entirely clear that this is required, but it makes for clear semantics: the subjective cred remains non-RCU as long as you only access it synchronously using the thread-local accessors, but you _can_ use it as a generic cred if you want to. It is possible that we should just remove the whole RCU markings for ->cred entirely. Only ->real_cred is really supposed to be accessed through RCU, and the long-term cred copies that nfs uses might want to explicitly re-enable RCU freeing if required, rather than have get_current_cred() do it implicitly. But this is a "minimal semantic changes" change for the immediate problem. Acked-by: Peter Zijlstra (Intel) Acked-by: Eric Dumazet Acked-by: Paul E. McKenney Cc: Oleg Nesterov Cc: Jan Glauber Cc: Jiri Kosina Cc: Jayachandran Chandrasekharan Nair Cc: Greg KH Cc: Kees Cook Cc: David Howells Cc: Miklos Szeredi Cc: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/open.c | 19 +++++++++++++++++++ include/linux/cred.h | 7 ++++++- kernel/cred.c | 21 +++++++++++++++++++-- 3 files changed, 44 insertions(+), 3 deletions(-) --- a/fs/open.c +++ b/fs/open.c @@ -379,6 +379,25 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con override_cred->cap_permitted; } + /* + * The new set of credentials can *only* be used in + * task-synchronous circumstances, and does not need + * RCU freeing, unless somebody then takes a separate + * reference to it. + * + * NOTE! This is _only_ true because this credential + * is used purely for override_creds() that installs + * it as the subjective cred. Other threads will be + * accessing ->real_cred, not the subjective cred. + * + * If somebody _does_ make a copy of this (using the + * 'get_current_cred()' function), that will clear the + * non_rcu field, because now that other user may be + * expecting RCU freeing. But normal thread-synchronous + * cred accesses will keep things non-RCY. + */ + override_cred->non_rcu = 1; + old_cred = override_creds(override_cred); retry: res = user_path_at(dfd, filename, lookup_flags, &path); --- a/include/linux/cred.h +++ b/include/linux/cred.h @@ -145,7 +145,11 @@ struct cred { struct user_struct *user; /* real user ID subscription */ struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */ struct group_info *group_info; /* supplementary groups for euid/fsgid */ - struct rcu_head rcu; /* RCU deletion hook */ + /* RCU deletion */ + union { + int non_rcu; /* Can we skip RCU deletion? */ + struct rcu_head rcu; /* RCU deletion hook */ + }; } __randomize_layout; extern void __put_cred(struct cred *); @@ -243,6 +247,7 @@ static inline const struct cred *get_cre { struct cred *nonconst_cred = (struct cred *) cred; validate_creds(cred); + nonconst_cred->non_rcu = 0; return get_new_cred(nonconst_cred); } --- a/kernel/cred.c +++ b/kernel/cred.c @@ -147,7 +147,10 @@ void __put_cred(struct cred *cred) BUG_ON(cred == current->cred); BUG_ON(cred == current->real_cred); - call_rcu(&cred->rcu, put_cred_rcu); + if (cred->non_rcu) + put_cred_rcu(&cred->rcu); + else + call_rcu(&cred->rcu, put_cred_rcu); } EXPORT_SYMBOL(__put_cred); @@ -258,6 +261,7 @@ struct cred *prepare_creds(void) old = task->cred; memcpy(new, old, sizeof(struct cred)); + new->non_rcu = 0; atomic_set(&new->usage, 1); set_cred_subscribers(new, 0); get_group_info(new->group_info); @@ -537,7 +541,19 @@ const struct cred *override_creds(const validate_creds(old); validate_creds(new); - get_cred(new); + + /* + * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'. + * + * That means that we do not clear the 'non_rcu' flag, since + * we are only installing the cred into the thread-synchronous + * '->cred' pointer, not the '->real_cred' pointer that is + * visible to other threads under RCU. + * + * Also note that we did validate_creds() manually, not depending + * on the validation in 'get_cred()'. + */ + get_new_cred((struct cred *)new); alter_cred_subscribers(new, 1); rcu_assign_pointer(current->cred, new); alter_cred_subscribers(old, -1); @@ -620,6 +636,7 @@ struct cred *prepare_kernel_cred(struct validate_creds(old); *new = *old; + new->non_rcu = 0; atomic_set(&new->usage, 1); set_cred_subscribers(new, 0); get_uid(new->user);