Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ad133ba3 authored Nov 17, 2008 by Oleg Nesterov Committed by Ingo Molnar Nov 17, 2008

sched, signals: fix the racy usage of ->signal in account_group_xxx/run_posix_cpu_timers



Impact: fix potential NULL dereference

Contrary to ad474cac changelog, other
acct_group_xxx() helpers can be called after exit_notify() by timer tick.
Thanks to Roland for pointing out this. Somehow I missed this simple fact
when I read the original patch, and I am afraid I confused Frank during
the discussion. Sorry.

Fortunately, these helpers work with current, we can check ->exit_state
to ensure that ->signal can't go away under us.

Also, add the comment and compiler barrier to account_group_exec_runtime(),
to make sure we load ->signal only once.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

parent 29d7b90c

kernel/posix-cpu-timers.c

+5 −2

Original line number	Original line	Diff line number	Diff line
	@@ -1308,9 +1308,10 @@ static inline int task_cputime_expired(const struct task_cputime *sample,
	*/		*/
	static inline int fastpath_timer_check(struct task_struct *tsk)		static inline int fastpath_timer_check(struct task_struct *tsk)
	{		{
	struct signal_struct *sig = tsk->signal;		struct signal_struct *sig;

	if (unlikely(!sig))		/* tsk == current, ensure it is safe to use ->signal/sighand */
			if (unlikely(tsk->exit_state))
	return 0;		return 0;

	if (!task_cputime_zero(&tsk->cputime_expires)) {		if (!task_cputime_zero(&tsk->cputime_expires)) {
	@@ -1323,6 +1324,8 @@ static inline int fastpath_timer_check(struct task_struct *tsk)
	if (task_cputime_expired(&task_sample, &tsk->cputime_expires))		if (task_cputime_expired(&task_sample, &tsk->cputime_expires))
	return 1;		return 1;
	}		}

			sig = tsk->signal;
	if (!task_cputime_zero(&sig->cputime_expires)) {		if (!task_cputime_zero(&sig->cputime_expires)) {
	struct task_cputime group_sample;		struct task_cputime group_sample;

kernel/sched_stats.h

+11 −4

Original line number	Original line	Diff line number	Diff line
	@@ -298,9 +298,11 @@ static inline void account_group_user_time(struct task_struct *tsk,
	{		{
	struct signal_struct *sig;		struct signal_struct *sig;

	sig = tsk->signal;		/* tsk == current, ensure it is safe to use ->signal */
	if (unlikely(!sig))		if (unlikely(tsk->exit_state))
	return;		return;

			sig = tsk->signal;
	if (sig->cputime.totals) {		if (sig->cputime.totals) {
	struct task_cputime *times;		struct task_cputime *times;

	@@ -325,9 +327,11 @@ static inline void account_group_system_time(struct task_struct *tsk,
	{		{
	struct signal_struct *sig;		struct signal_struct *sig;

	sig = tsk->signal;		/* tsk == current, ensure it is safe to use ->signal */
	if (unlikely(!sig))		if (unlikely(tsk->exit_state))
	return;		return;

			sig = tsk->signal;
	if (sig->cputime.totals) {		if (sig->cputime.totals) {
	struct task_cputime *times;		struct task_cputime *times;

	@@ -353,8 +357,11 @@ static inline void account_group_exec_runtime(struct task_struct *tsk,
	struct signal_struct *sig;		struct signal_struct *sig;

	sig = tsk->signal;		sig = tsk->signal;
			/* see __exit_signal()->task_rq_unlock_wait() */
			barrier();
	if (unlikely(!sig))		if (unlikely(!sig))
	return;		return;

	if (sig->cputime.totals) {		if (sig->cputime.totals) {
	struct task_cputime *times;		struct task_cputime *times;