Commit d183b812 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Guo Mengqi
Browse files

fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() 

mainline inclusion
from mainline-v6.8-rc4
commit 60f92acb60a989b14e4b744501a0df0f82ef30a3
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EL
CVE: CVE-2024-26686

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=60f92acb60a989b14e4b744501a0df0f82ef30a3

--------------------------------

Patch series "fs/proc: do_task_stat: use sig->stats_".

do_task_stat() has the same problem as getrusage() had before "getrusage:
use sig->stats_lock rather than lock_task_sighand()": a hard lockup.  If
NR_CPUS threads call lock_task_sighand() at the same time and the process
has NR_THREADS, spin_lock_irq will spin with irqs disabled O(NR_CPUS *
NR_THREADS) time.

This patch (of 3):

thread_group_cputime() does its own locking, we can safely shift
thread_group_cputime_adjusted() which does another for_each_thread loop
outside of ->siglock protected section.

Not only this removes for_each_thread() from the critical section with
irqs disabled, this removes another case when stats_lock is taken with
siglock held.  We want to remove this dependency, then we can change the
users of stats_lock to not disable irqs.

Link: https://lkml.kernel.org/r/20240123153313.GA21832@redhat.com
Link: https://lkml.kernel.org/r/20240123153355.GA21854@redhat.com


Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarDylan Hatch <dylanbhatch@google.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>

 Conflicts:
	fs/proc/array.c

Signed-off-by: default avatarZhao Wenhui <zhaowenhui8@huawei.com>
parent 34258903

fs/proc/array.c

+6 −4
Original line number Diff line number Diff line
@@ -490,7 +490,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, 


	sigemptyset(&sigign);

	sigemptyset(&sigcatch);

	cutime = cstime = utime = stime = 0;

	cutime = cstime = 0;

	cgtime = gtime = 0;



	if (lock_task_sighand(task, &flags)) {
@@ -524,7 +524,6 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, 


			min_flt += sig->min_flt;

			maj_flt += sig->maj_flt;

			thread_group_cputime_adjusted(task, &utime, &stime);

			gtime += sig->gtime;



			if (sig->flags & (SIGNAL_GROUP_EXIT | SIGNAL_STOP_STOPPED))
@@ -540,10 +539,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, 


	if (permitted && (!whole || num_threads < 2))

		wchan = get_wchan(task);

	if (!whole) {



	if (whole) {

		thread_group_cputime_adjusted(task, &utime, &stime);

	} else {

		task_cputime_adjusted(task, &utime, &stime);

		min_flt = task->min_flt;

		maj_flt = task->maj_flt;

		task_cputime_adjusted(task, &utime, &stime);

		gtime = task_gtime(task);

	}