From 5054fff67d13eb965267223c5c2742ff48be14f4 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Wed, 2 Mar 2022 22:04:23 +0100
Subject: [PATCH] ptrace: fix ptrace vs tasklist_lock race on PREEMPT_RT.
References: SLE Realtime Extension
Patch-mainline: Queued in subsystem maintainer repository
Git-commit: 3c7c29c8b1c5010c88e1115672e1f44589002cde
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-rt-devel.git
As explained by Alexander Fyodorov <halcy@yandex.ru>:
|read_lock(&tasklist_lock) in ptrace_stop() is converted to sleeping
|lock on a PREEMPT_RT kernel, and it can remove __TASK_TRACED from
|task->state (by moving it to task->saved_state). If parent does
|wait() on child followed by a sys_ptrace call, the following race can
|happen:
|
|- child sets __TASK_TRACED in ptrace_stop()
|- parent does wait() which eventually calls wait_task_stopped() and returns
| child's pid
|- child blocks on read_lock(&tasklist_lock) in ptrace_stop() and moves
| __TASK_TRACED flag to saved_state
|- parent calls sys_ptrace, which calls ptrace_check_attach() and
| wait_task_inactive()
The patch is based on his initial patch where an additional check is
added in case the __TASK_TRACED moved to ->saved_state. The pi_lock is
taken in case the caller is interrupted between looking into ->state and
->saved_state.
[ Fix for ptrace_unfreeze_traced() by Oleg Nesterov ]
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/Yh/b19JikC+Vnm8i@linutronix.de
Signed-off-by: Mel Gorman <mgorman@suse.de>
---
include/linux/sched.h | 127 ++++++++++++++++++++++++++++++++++++++++++++++++--
kernel/ptrace.c | 25 +++++-----
kernel/sched/core.c | 5 +-
3 files changed, 140 insertions(+), 17 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6401d10226a6..c511bdc476e7 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -118,12 +118,8 @@ struct task_group;
#define task_is_running(task) (READ_ONCE((task)->__state) == TASK_RUNNING)
-#define task_is_traced(task) ((READ_ONCE(task->__state) & __TASK_TRACED) != 0)
-
#define task_is_stopped(task) ((READ_ONCE(task->__state) & __TASK_STOPPED) != 0)
-#define task_is_stopped_or_traced(task) ((READ_ONCE(task->__state) & (__TASK_STOPPED | __TASK_TRACED)) != 0)
-
/*
* Special states are those that do not use the normal wait-loop pattern. See
* the comment with set_special_state().
@@ -1984,6 +1980,129 @@ static inline int test_tsk_need_resched(struct task_struct *tsk)
return unlikely(test_tsk_thread_flag(tsk,TIF_NEED_RESCHED));
}
+#ifdef CONFIG_PREEMPT_RT
+
+static inline bool task_state_match_and(struct task_struct *tsk, long state)
+{
+ unsigned long flags;
+ bool match = false;
+
+ raw_spin_lock_irqsave(&tsk->pi_lock, flags);
+ if (READ_ONCE(tsk->__state) & state)
+ match = true;
+ else if (tsk->saved_state & state)
+ match = true;
+ raw_spin_unlock_irqrestore(&tsk->pi_lock, flags);
+ return match;
+}
+
+static inline bool __task_state_match_eq(struct task_struct *tsk, long state)
+{
+ bool match = false;
+
+ if (READ_ONCE(tsk->__state) == state)
+ match = true;
+ else if (tsk->saved_state == state)
+ match = true;
+ return match;
+}
+
+static inline bool task_state_match_eq(struct task_struct *tsk, long state)
+{
+ unsigned long flags;
+ bool match;
+
+ raw_spin_lock_irqsave(&tsk->pi_lock, flags);
+ match = __task_state_match_eq(tsk, state);
+ raw_spin_unlock_irqrestore(&tsk->pi_lock, flags);
+ return match;
+}
+
+static inline bool task_state_match_and_set(struct task_struct *tsk, long state,
+ long new_state)
+{
+ unsigned long flags;
+ bool match = false;
+
+ raw_spin_lock_irqsave(&tsk->pi_lock, flags);
+ if (READ_ONCE(tsk->__state) & state) {
+ WRITE_ONCE(tsk->__state, new_state);
+ match = true;
+ } else if (tsk->saved_state & state) {
+ tsk->__state = new_state;
+ match = true;
+ }
+ raw_spin_unlock_irqrestore(&tsk->pi_lock, flags);
+ return match;
+}
+
+static inline bool task_state_match_eq_set(struct task_struct *tsk, long state,
+ long new_state)
+{
+ unsigned long flags;
+ bool match = false;
+
+ raw_spin_lock_irqsave(&tsk->pi_lock, flags);
+ if (READ_ONCE(tsk->__state) == state) {
+ WRITE_ONCE(tsk->__state, new_state);
+ match = true;
+ } else if (tsk->saved_state == state) {
+ tsk->saved_state = new_state;
+ match = true;
+ }
+ raw_spin_unlock_irqrestore(&tsk->pi_lock, flags);
+ return match;
+}
+
+#else
+
+static inline bool task_state_match_and(struct task_struct *tsk, long state)
+{
+ return READ_ONCE(tsk->__state) & state;
+}
+
+static inline bool __task_state_match_eq(struct task_struct *tsk, long state)
+{
+ return READ_ONCE(tsk->__state) == state;
+}
+
+static inline bool task_state_match_eq(struct task_struct *tsk, long state)
+{
+ return __task_state_match_eq(tsk, state);
+}
+
+static inline bool task_state_match_and_set(struct task_struct *tsk, long state,
+ long new_state)
+{
+ if (READ_ONCE(tsk->__state) & state) {
+ WRITE_ONCE(tsk->__state, new_state);
+ return true;
+ }
+ return false;
+}
+
+static inline bool task_state_match_eq_set(struct task_struct *tsk, long state,
+ long new_state)
+{
+ if (READ_ONCE(tsk->__state) == state) {
+ WRITE_ONCE(tsk->__state, new_state);
+ return true;
+ }
+ return false;
+}
+
+#endif
+
+static inline bool task_is_traced(struct task_struct *tsk)
+{
+ return task_state_match_and(tsk, __TASK_TRACED);
+}
+
+static inline bool task_is_stopped_or_traced(struct task_struct *tsk)
+{
+ return task_state_match_and(tsk, __TASK_STOPPED | __TASK_TRACED);
+}
+
/*
* cond_resched() and cond_resched_lock(): latency reduction via
* explicit rescheduling in places that are safe. The return
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index f8589bf8d7dc..724945dc26f3 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -195,10 +195,10 @@ static bool ptrace_freeze_traced(struct task_struct *task)
return ret;
spin_lock_irq(&task->sighand->siglock);
- if (task_is_traced(task) && !looks_like_a_spurious_pid(task) &&
- !__fatal_signal_pending(task)) {
- WRITE_ONCE(task->__state, __TASK_TRACED);
- ret = true;
+ if (!looks_like_a_spurious_pid(task) && !__fatal_signal_pending(task)) {
+
+ ret = task_state_match_and_set(task, __TASK_TRACED,
+ __TASK_TRACED);
}
spin_unlock_irq(&task->sighand->siglock);
@@ -207,7 +207,10 @@ static bool ptrace_freeze_traced(struct task_struct *task)
static void ptrace_unfreeze_traced(struct task_struct *task)
{
- if (READ_ONCE(task->__state) != __TASK_TRACED)
+ bool frozen;
+
+ if (!IS_ENABLED(CONFIG_PREEMPT_RT) &&
+ READ_ONCE(task->__state) != __TASK_TRACED)
return;
WARN_ON(!task->ptrace || task->parent != current);
@@ -217,12 +220,12 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
* Recheck state under the lock to close this race.
*/
spin_lock_irq(&task->sighand->siglock);
- if (READ_ONCE(task->__state) == __TASK_TRACED) {
- if (__fatal_signal_pending(task))
- wake_up_state(task, __TASK_TRACED);
- else
- WRITE_ONCE(task->__state, TASK_TRACED);
- }
+
+ frozen = task_state_match_eq_set(task, __TASK_TRACED, TASK_TRACED);
+
+ if (frozen && __fatal_signal_pending(task))
+ wake_up_state(task, __TASK_TRACED);
+
spin_unlock_irq(&task->sighand->siglock);
}
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 162471e32af9..82f90696df7c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3050,7 +3050,8 @@ unsigned long wait_task_inactive(struct task_struct *p, unsigned int match_state
* is actually now running somewhere else!
*/
while (task_running(rq, p)) {
- if (match_state && unlikely(READ_ONCE(p->__state) != match_state))
+ if (match_state &&
+ unlikely(!task_state_match_eq(p, match_state)))
return 0;
cpu_relax();
}
@@ -3065,7 +3066,7 @@ unsigned long wait_task_inactive(struct task_struct *p, unsigned int match_state
running = task_running(rq, p);
queued = task_on_rq_queued(p);
ncsw = 0;
- if (!match_state || READ_ONCE(p->__state) == match_state)
+ if (!match_state || __task_state_match_eq(p, match_state))
ncsw = p->nvcsw | LONG_MIN; /* sets MSB */
task_rq_unlock(rq, p, &rf);