The "bug" is still present in Google Chrome Stable version: 5.0.375.86
Ben Hutchings wrote:
<snip> I think we should actually apply a second patch. So, please
try the two attached patches <snip> Please test this fix by following
the instructions at
http://kernel-handbook.alioth.debian.org/ch-common-tasks.html#s-common-official
I have enclosed those patches for the bug report. They were built on
source containing linux-2.6_2.6.26-24.dsc and tested on two Amd SMPs:
AMD Turion(tm) 64 X2 Mobile Technology TL-60
Quad-Core AMD Opteron(tm) Processor 1352
Prior to the patch I could sometimes force the kernel problem by opening
Chrome say 4 times, open some sites, leave a while then closing all the
chrome windows quickly. After two-ish days of pretty intense usage so
far no repeat of the kernel BUG message. And for me these patches don't
regress other things.
BUT (and its a big BUT). Chrome 5 continues to use root setuid. So I
doubt that this is the end of the kernel bug story. I have updated the
Chrome fault log accordingly:
http://code.google.com/p/chromium/issues/detail?id=35440
I really would be happier if there were no root setuid involved in a
browser. Also I am not sure there is enough demand here to warrant a
change to the production Debian kernels.
Much as it hurts: The answer for me, at least until we understand a
little more about the sandbox, is to simply avoid using Google Chrome.
Wait and see?
Berni
From: Oleg Nesterov <o...@tv-sign.ru>
Date: Tue, 2 Sep 2008 14:35:48 -0700
Subject: [PATCH 1/2] pid_ns: zap_pid_ns_processes: fix the ->child_reaper changing
commit add0d4dfd660e9e4fd0af3eac3cad23583c9558f upstream.
zap_pid_ns_processes() sets pid_ns->child_reaper = NULL, this is wrong.
Yes, we have already killed all tasks in this namespace, and sys_wait4()
doesn't see any child. But this doesn't mean ->children list is empty, we
may have EXIT_DEAD tasks which are not visible to do_wait(). In that case
the subsequent forget_original_parent() will crash the kernel because it
will try to re-parent these tasks to the NULL reaper.
Even if there are no childs, it is not good that forget_original_parent()
uses reaper == NULL.
Change the code to set ->child_reaper = init_pid_ns.child_reaper instead.
We could use pid_ns->parent->child_reaper as well, I think this does not
really matter. These EXIT_DEAD tasks are not visible to the new ->parent
after re-parenting, they will silently do release_task() eventually.
Note that we must change ->child_reaper, otherwise
forget_original_parent() will use reaper == father, and in that case we
will hit the (correct) BUG_ON(!list_empty(&father->children)).
Signed-off-by: Oleg Nesterov <o...@tv-sign.ru>
Acked-by: Serge Hallyn <se...@us.ibm.com>
Acked-by: Sukadev Bhattiprolu <suka...@linux.vnet.ibm.com>
Acked-by: Pavel Emelyanov <xe...@openvz.org>
Signed-off-by: Andrew Morton <a...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torva...@linux-foundation.org>
[bwh: Adjust context for 2.6.26]
---
kernel/pid_namespace.c | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index ea567b7..598f1ee 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -182,9 +182,12 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
rc = sys_wait4(-1, NULL, __WALL, NULL);
} while (rc != -ECHILD);
-
- /* Child reaper for the pid namespace is going away */
- pid_ns->child_reaper = NULL;
+ /*
+ * We can not clear ->child_reaper or leave it alone.
+ * There may by stealth EXIT_DEAD tasks on ->children,
+ * forget_original_parent() must move them somewhere.
+ */
+ pid_ns->child_reaper = init_pid_ns.child_reaper;
return;
}
From: Oleg Nesterov <o...@tv-sign.ru>
Date: Tue, 2 Sep 2008 14:35:49 -0700
Subject: [PATCH 2/2] pid_ns: (BUG 11391) change ->child_reaper when init->group_leader exits
commit 950bbabb5a804690a0201190de5c22837f72f83f upstream.
We don't change pid_ns->child_reaper when the main thread of the
subnamespace init exits. As Robert Rex <robert....@exasol.com> pointed
out this is wrong.
Yes, the re-parenting itself works correctly, but if the reparented task
exits it needs ->parent->nsproxy->pid_ns in do_notify_parent(), and if the
main thread is zombie its ->nsproxy was already cleared by
exit_task_namespaces().
Introduce the new function, find_new_reaper(), which finds the new
->parent for the re-parenting and changes ->child_reaper if needed. Kill
the now unneeded exit_child_reaper().
Also move the changing of ->child_reaper from zap_pid_ns_processes() to
find_new_reaper(), this consolidates the games with ->child_reaper and
makes it stable under tasklist_lock.
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11391
Reported-by: Robert Rex <robert....@exasol.com>
Signed-off-by: Oleg Nesterov <o...@tv-sign.ru>
Acked-by: Serge Hallyn <se...@us.ibm.com>
Acked-by: Pavel Emelyanov <xe...@openvz.org>
Acked-by: Sukadev Bhattiprolu <suka...@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <a...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torva...@linux-foundation.org>
[bwh: Adjust context for 2.6.26]
---
kernel/exit.c | 78 +++++++++++++++++++++---------------------------
kernel/pid_namespace.c | 6 ----
2 files changed, 34 insertions(+), 50 deletions(-)
diff --git a/kernel/exit.c b/kernel/exit.c
index 75c6473..25ed2ad 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -758,23 +758,48 @@ static void reparent_thread(struct task_struct *p, struct task_struct *father)
* the child reaper process (ie "init") in our pid
* space.
*/
+static struct task_struct *find_new_reaper(struct task_struct *father)
+{
+ struct pid_namespace *pid_ns = task_active_pid_ns(father);
+ struct task_struct *thread;
+
+ thread = father;
+ while_each_thread(father, thread) {
+ if (thread->flags & PF_EXITING)
+ continue;
+ if (unlikely(pid_ns->child_reaper == father))
+ pid_ns->child_reaper = thread;
+ return thread;
+ }
+
+ if (unlikely(pid_ns->child_reaper == father)) {
+ write_unlock_irq(&tasklist_lock);
+ if (unlikely(pid_ns == &init_pid_ns))
+ panic("Attempted to kill init!");
+
+ zap_pid_ns_processes(pid_ns);
+ write_lock_irq(&tasklist_lock);
+ /*
+ * We can not clear ->child_reaper or leave it alone.
+ * There may by stealth EXIT_DEAD tasks on ->children,
+ * forget_original_parent() must move them somewhere.
+ */
+ pid_ns->child_reaper = init_pid_ns.child_reaper;
+ }
+
+ return pid_ns->child_reaper;
+}
+
static void forget_original_parent(struct task_struct *father)
{
- struct task_struct *p, *n, *reaper = father;
+ struct task_struct *p, *n, *reaper;
struct list_head ptrace_dead;
INIT_LIST_HEAD(&ptrace_dead);
write_lock_irq(&tasklist_lock);
+ reaper = find_new_reaper(father);
- do {
- reaper = next_thread(reaper);
- if (reaper == father) {
- reaper = task_child_reaper(father);
- break;
- }
- } while (reaper->flags & PF_EXITING);
-
/*
* There are only two places where our children can be:
*
@@ -929,39 +954,6 @@ static void check_stack_usage(void)
static inline void check_stack_usage(void) {}
#endif
-static inline void exit_child_reaper(struct task_struct *tsk)
-{
- if (likely(tsk->group_leader != task_child_reaper(tsk)))
- return;
-
- if (tsk->nsproxy->pid_ns == &init_pid_ns)
- panic("Attempted to kill init!");
-
- /*
- * @tsk is the last thread in the 'cgroup-init' and is exiting.
- * Terminate all remaining processes in the namespace and reap them
- * before exiting @tsk.
- *
- * Note that @tsk (last thread of cgroup-init) may not necessarily
- * be the child-reaper (i.e main thread of cgroup-init) of the
- * namespace i.e the child_reaper may have already exited.
- *
- * Even after a child_reaper exits, we let it inherit orphaned children,
- * because, pid_ns->child_reaper remains valid as long as there is
- * at least one living sub-thread in the cgroup init.
-
- * This living sub-thread of the cgroup-init will be notified when
- * a child inherited by the 'child-reaper' exits (do_notify_parent()
- * uses __group_send_sig_info()). Further, when reaping child processes,
- * do_wait() iterates over children of all living sub threads.
-
- * i.e even though 'child_reaper' thread is listed as the parent of the
- * orphaned children, any living sub-thread in the cgroup-init can
- * perform the role of the child_reaper.
- */
- zap_pid_ns_processes(tsk->nsproxy->pid_ns);
-}
-
NORET_TYPE void do_exit(long code)
{
struct task_struct *tsk = current;
@@ -1024,7 +1016,6 @@ NORET_TYPE void do_exit(long code)
}
group_dead = atomic_dec_and_test(&tsk->signal->live);
if (group_dead) {
- exit_child_reaper(tsk);
hrtimer_cancel(&tsk->signal->real_timer);
exit_itimers(tsk->signal);
}
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 598f1ee..fab8ea8 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -182,12 +182,6 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
rc = sys_wait4(-1, NULL, __WALL, NULL);
} while (rc != -ECHILD);
- /*
- * We can not clear ->child_reaper or leave it alone.
- * There may by stealth EXIT_DEAD tasks on ->children,
- * forget_original_parent() must move them somewhere.
- */
- pid_ns->child_reaper = init_pid_ns.child_reaper;
return;
}
