Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1626314

[PATCH 4.4 01/45] cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 77f88796cee819b9c4562b0b6b44691b3b7755b1 upstream.

Creation of a kthread goes through a couple interlocked stages between
the kthread itself and its creator.  Once the new kthread starts
running, it initializes itself and wakes up the creator.  The creator
then can further configure the kthread and then let it start doing its
job by waking it up.

In this configuration-by-creator stage, the creator is the only one
that can wake it up but the kthread is visible to userland.  When
altering the kthread's attributes from userland is allowed, this is
fine; however, for cases where CPU affinity is critical,
kthread_bind() is used to first disable affinity changes from userland
and then set the affinity.  This also prevents the kthread from being
migrated into non-root cgroups as that can affect the CPU affinity and
many other things.

Unfortunately, the cgroup side of protection is racy.  While the
PF_NO_SETAFFINITY flag prevents further migrations, userland can win
the race before the creator sets the flag with kthread_bind() and put
the kthread in a non-root cgroup, which can lead to all sorts of
problems including incorrect CPU affinity and starvation.

This bug got triggered by userland which periodically tries to migrate
all processes in the root cpuset cgroup to a non-root one.  Per-cpu
workqueue workers got caught while being created and ended up with
incorrected CPU affinity breaking concurrency management and sometimes
stalling workqueue execution.

This patch adds task->no_cgroup_migration which disallows the task to
be migrated by userland.  kthreadd starts with the flag set making
every child kthread start in the root cgroup with migration
disallowed.  The flag is cleared after the kthread finishes
initialization by which time PF_NO_SETAFFINITY is set if the kthread
should stay in the root cgroup.

It'd be better to wait for the initialization instead of failing but I
couldn't think of a way of implementing that without adding either a
new PF flag, or sleeping and retrying from waiting side.  Even if
userland depends on changing cgroup membership of a kthread, it either
has to be synchronized with kthread_create() or periodically repeat,
so it's unlikely that this would break anything.

v2: Switch to a simpler implementation using a new task_struct bit
    field suggested by Oleg.

Signed-off-by: Tejun Heo <tj@kernel.org>
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Reported-and-debugged-by: Chris Mason <clm@fb.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/cgroup.h |   21 +++++++++++++++++++++
 include/linux/sched.h  |    4 ++++
 kernel/cgroup.c        |    9 +++++----
 kernel/kthread.c       |    3 +++
 4 files changed, 33 insertions(+), 4 deletions(-)

--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -528,6 +528,25 @@ static inline void pr_cont_cgroup_path(s
 	pr_cont_kernfs_path(cgrp->kn);
 }
 
+static inline void cgroup_init_kthreadd(void)
+{
+	/*
+	 * kthreadd is inherited by all kthreads, keep it in the root so
+	 * that the new kthreads are guaranteed to stay in the root until
+	 * initialization is finished.
+	 */
+	current->no_cgroup_migration = 1;
+}
+
+static inline void cgroup_kthread_ready(void)
+{
+	/*
+	 * This kthread finished initialization.  The creator should have
+	 * set PF_NO_SETAFFINITY if this kthread should stay in the root.
+	 */
+	current->no_cgroup_migration = 0;
+}
+
 #else /* !CONFIG_CGROUPS */
 
 struct cgroup_subsys_state;
@@ -551,6 +570,8 @@ static inline void cgroup_free(struct ta
 
 static inline int cgroup_init_early(void) { return 0; }
 static inline int cgroup_init(void) { return 0; }
+static inline void cgroup_init_kthreadd(void) {}
+static inline void cgroup_kthread_ready(void) {}
 
 #endif /* !CONFIG_CGROUPS */
 
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1475,6 +1475,10 @@ struct task_struct {
 #ifdef CONFIG_COMPAT_BRK
 	unsigned brk_randomized:1;
 #endif
+#ifdef CONFIG_CGROUPS
+	/* disallow userland-initiated cgroup migration */
+	unsigned no_cgroup_migration:1;
+#endif
 
 	unsigned long atomic_flags; /* Flags needing atomic access. */
 
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2752,11 +2752,12 @@ static ssize_t __cgroup_procs_write(stru
 		tsk = tsk->group_leader;
 
 	/*
-	 * Workqueue threads may acquire PF_NO_SETAFFINITY and become
-	 * trapped in a cpuset, or RT worker may be born in a cgroup
-	 * with no rt_runtime allocated.  Just say no.
+	 * kthreads may acquire PF_NO_SETAFFINITY during initialization.
+	 * If userland migrates such a kthread to a non-root cgroup, it can
+	 * become trapped in a cpuset, or RT kthread may be born in a
+	 * cgroup with no rt_runtime allocated.  Just say no.
 	 */
-	if (tsk == kthreadd_task || (tsk->flags & PF_NO_SETAFFINITY)) {
+	if (tsk->no_cgroup_migration || (tsk->flags & PF_NO_SETAFFINITY)) {
 		ret = -EINVAL;
 		goto out_unlock_rcu;
 	}
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -18,6 +18,7 @@
 #include <linux/freezer.h>
 #include <linux/ptrace.h>
 #include <linux/uaccess.h>
+#include <linux/cgroup.h>
 #include <trace/events/sched.h>
 
 static DEFINE_SPINLOCK(kthread_create_lock);
@@ -205,6 +206,7 @@ static int kthread(void *_create)
 	ret = -EINTR;
 
 	if (!test_bit(KTHREAD_SHOULD_STOP, &self.flags)) {
+		cgroup_kthread_ready();
 		__kthread_parkme(&self);
 		ret = threadfn(data);
 	}
@@ -510,6 +512,7 @@ int kthreadd(void *unused)
 	set_mems_allowed(node_states[N_MEMORY]);
 
 	current->flags |= PF_NOFREEZE;
+	cgroup_init_kthreadd();
 
 	for (;;) {
 		set_current_state(TASK_INTERRUPTIBLE);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/45] 4.4.63-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
  [PATCH 4.4 44/45] sctp: deny peeloff operation on asocs with threads sleeping on it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
  [PATCH 4.4 32/45] mm: Tighten x86 /dev/mem with zeroing reads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
  [PATCH 4.4 16/45] xen, fbfront: fix connecting to backend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 15/45] scsi: sd: Fix capacity calculation with 32-bit sector_t Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 27/45] ath9k: fix NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 20/45] char: Drop bogus dependency of DEVPORT on !M68K Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 11/45] iscsi-target: Fix TMR reference leak during session shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 23/45] kvm: fix page struct leak in handle_vmon Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 12/45] iscsi-target: Drop work-around for legacy GlobalSAN initiator Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 10/45] acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 14/45] scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 03/45] drm/nouveau/mpeg: mthd returns true on success now Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 06/45] Input: xpad - add support for Razer Wildcat gamepad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 39/45] catc: Use heap buffer for memory size test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 25/45] powerpc: Disable HFSCR[TM] if TM is not supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 07/45] perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 41/45] SUNRPC: fix refcounting problems with auth_gss messages. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 02/45] thp: fix MADV_DONTNEED vs clear soft dirty race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 31/45] rtc: tegra: Implement clock handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 17/45] libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 05/45] CIFS: store results of cifs_reopen_file to avoid infinite wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 08/45] x86/vdso: Ensure vdso32_enabled gets set to valid values only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 40/45] ibmveth: calculate gso_segs for large packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 21/45] char: lack of bool string made CONFIG_DEVPORT always on Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 42/45] tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 38/45] catc: Combine failure cleanup code in catc_probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 26/45] crypto: ahash - Fix EINPROGRESS notification callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 01/45] cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  Re: [PATCH 4.4 00/45] 4.4.63-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-19 22:40 +0200
  Re: [PATCH 4.4 00/45] 4.4.63-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-20 01:30 +0200

csiph-web