lkml.org 
[lkml]   [2021]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 17/19] sched: Inherit task cookie on fork()
From
Date
On 5/10/21 12:06 PM, Joel Fernandes wrote:
> Hi Peter,
>
> On Thu, Apr 22, 2021 at 8:36 AM Peter Zijlstra <peterz@infradead.org> wrote:
>>
>> Note that sched_core_fork() is called from under tasklist_lock, and
>> not from sched_fork() earlier. This avoids a few races later.
>>
>> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
>> ---
>> include/linux/sched.h | 2 ++
>> kernel/fork.c | 3 +++
>> kernel/sched/core_sched.c | 6 ++++++
>> 3 files changed, 11 insertions(+)
>>
>> --- a/include/linux/sched.h
>> +++ b/include/linux/sched.h
>> @@ -2172,8 +2172,10 @@ const struct cpumask *sched_trace_rd_spa
>>
>> #ifdef CONFIG_SCHED_CORE
>> extern void sched_core_free(struct task_struct *tsk);
>> +extern void sched_core_fork(struct task_struct *p);
>> #else
>> static inline void sched_core_free(struct task_struct *tsk) { }
>> +static inline void sched_core_fork(struct task_struct *p) { }
>> #endif
>>
>> #endif
>> --- a/kernel/fork.c
>> +++ b/kernel/fork.c
>> @@ -2249,6 +2249,8 @@ static __latent_entropy struct task_stru
>>
>> klp_copy_process(p);
>>
>> + sched_core_fork(p);
>> +
>> spin_lock(&current->sighand->siglock);
>>
>> /*
>> @@ -2336,6 +2338,7 @@ static __latent_entropy struct task_stru
>> return p;
>>
>> bad_fork_cancel_cgroup:
>> + sched_core_free(p);
>> spin_unlock(&current->sighand->siglock);
>> write_unlock_irq(&tasklist_lock);
>> cgroup_cancel_fork(p, args);
>> --- a/kernel/sched/core_sched.c
>> +++ b/kernel/sched/core_sched.c
>> @@ -100,6 +100,12 @@ static unsigned long sched_core_clone_co
>> return cookie;
>> }
>>
>> +void sched_core_fork(struct task_struct *p)
>> +{
>> + RB_CLEAR_NODE(&p->core_node);
>> + p->core_cookie = sched_core_clone_cookie(current);
>
> Does this make sense also for !CLONE_THREAD forks?

Yes. Given the absence of a cgroup interface, fork inheritance (clone the cookie) is the best way to create shared
cookie hierarchies. The security issue you mentioned was handled in my original code by setting a unique cookie on
'exec', but Peter took that out for the reason mentioned above. It was part of the "lets get this in compromise" effort.

-chrish

\
 
 \ /
  Last update: 2021-05-10 18:23    [W:0.107 / U:0.792 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site