Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Tue, 12 Nov 2019 16:26:51 +0100
From:   Adrian Reber <areber@redhat.com>
To:     Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc:     Christian Brauner <christian.brauner@ubuntu.com>,
        Eric Biederman <ebiederm@xmission.com>,
        Pavel Emelyanov <ovzxemul@gmail.com>,
        Jann Horn <jannh@google.com>, Oleg Nesterov <oleg@redhat.com>,
        Dmitry Safonov <0x7f454c46@gmail.com>,
        linux-kernel@vger.kernel.org, Andrei Vagin <avagin@gmail.com>,
        Mike Rapoport <rppt@linux.ibm.com>,
        Radostin Stoyanov <rstoyanov1@gmail.com>
Subject: Re: [PATCH v7 1/2] fork: extend clone3() to support setting a PID
Message-ID: <20191112152651.GB667444@dcbz.redhat.com>
References: <20191111131704.656169-1-areber@redhat.com>
 <cc5f90b6-ea1f-dbdb-e713-cc0fceceafbe@rasmusvillemoes.dk>
MIME-Version: 1.0
In-Reply-To: <cc5f90b6-ea1f-dbdb-e713-cc0fceceafbe@rasmusvillemoes.dk>
Organization: Red Hat
User-Agent: Mutt/1.12.1 (2019-06-15)
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Nov 11, 2019 at 09:41:39PM +0100, Rasmus Villemoes wrote:
> On 11/11/2019 14.17, Adrian Reber wrote:
> > The main motivation to add set_tid to clone3() is CRIU.
> >=20
> > To restore a process with the same PID/TID CRIU currently uses
> > /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
> > ns_last_pid and then (quickly) does a clone(). This works most of the
> > time, but it is racy. It is also slow as it requires multiple syscalls.
> >=20
> > Extending clone3() to support *set_tid makes it possible restore a
> > process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
> > race free (as long as the desired PID/TID is available).
> >=20
> > This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
> > on clone3() with *set_tid as they are currently in place for ns_last_pi=
d.
> >=20
> > The original version of this change was using a single value for
> > set_tid. At the 2019 LPC, after presenting set_tid, it was, however,
> > decided to change set_tid to an array to enable setting the PID of a
> > process in multiple PID namespaces at the same time. If a process is
> > created in a PID namespace it is possible to influence the PID inside
> > and outside of the PID namespace. Details also in the corresponding
> > selftest.
> >=20
>=20
> >  =09/*
> >  =09 * Verify that higher 32bits of exit_signal are unset and that
> >  =09 * it is a valid signal
> > @@ -2556,8 +2561,17 @@ noinline static int copy_clone_args_from_user(st=
ruct kernel_clone_args *kargs,
> >  =09=09.stack=09=09=3D args.stack,
> >  =09=09.stack_size=09=3D args.stack_size,
> >  =09=09.tls=09=09=3D args.tls,
> > +=09=09.set_tid=09=3D kargs->set_tid,
> > +=09=09.set_tid_size=09=3D args.set_tid_size,
> >  =09};
>=20
> This is a bit ugly. And is it even well-defined? I mean, it's a bit
> similar to the "i =3D i++;". So it would be best to avoid.
>=20
> > +=09for (i =3D 0; i < args.set_tid_size; i++) {
> > +=09=09if (copy_from_user(&kargs->set_tid[i],
> > +=09=09    u64_to_user_ptr(args.set_tid + (i * sizeof(args.set_tid))),
> > +=09=09    sizeof(pid_t)))
> > +=09=09=09return -EFAULT;
> > +=09}
> > +
>=20
> If I'm reading this (and your test case) right, you expect the user
> pointer to point at an array of u64, and here you're copying the first
> half of each u64 to the pid_t array. That only works on little-endian.
>=20
> It seems more obvious (since I don't think there's any disagreement
> anywhere on sizeof(pid_t)) to expect the user pointer to point at an
> array of pid_t and then simply copy_from_user() the whole thing in one go=
.
>=20
> >  =09return 0;
> >  }
> > =20
> > @@ -2631,6 +2645,10 @@ SYSCALL_DEFINE2(clone3, struct clone_args __user=
 *, uargs, size_t, size)
> >  =09int err;
> > =20
> >  =09struct kernel_clone_args kargs;
> > +=09pid_t set_tid[MAX_PID_NS_LEVEL];
> > +
> > +=09memset(set_tid, 0, sizeof(set_tid));
> > +=09kargs.set_tid =3D set_tid;
>=20
> Hm, isn't it a bit much to add two cachelines (and dirtying them via the
> memset) to the stack footprint of clone3, considering that almost nobody
> (relatively speaking) will use this?
>=20
> So how about copy_clone_args_from_user() does
>=20
> if (args.set_tid) {
>   set_tid =3D memdup_user(u64_to_user_ptr(), ...)
>   if (IS_ERR(set_tid))
>     return PTR_ERR(set_tid);
>   kargs.set_tid =3D set_tid;
> }
>=20
> Then somebody needs to free that, but this is probably not the last
> clone extension that might need extra data, so one could do
>=20
> s/long _do_fork/static long __do_fork/
>=20
> and then create a _do_fork that always cleans up the passed-in kargs, i.e=
.
>=20
> long _do_fork(struct kargs *args)
> {
>   long ret =3D __do_fork(args);
>   kfree(args->set_tid);
>   return ret;
> }

Thanks for your review. Did you had a look at what Christian suggested?
That should solve most of the points you mentioned. I will also remove
the memset() as it is not necessary at all.

=09=09Adrian