From patchwork Thu Jul 7 11:17:07 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [hardy, CVE, 1/1] taskstats: don't allow duplicate entries in listener mode Date: Thu, 07 Jul 2011 01:17:07 -0000 From: Andy Whitcroft X-Patchwork-Id: 103639 Message-Id: <1310037428-20088-2-git-send-email-apw@canonical.com> To: kernel-team@lists.ubuntu.com From: Vasiliy Kulikov Currently a single process may register exit handlers unlimited times. It may lead to a bloated listeners chain and very slow process terminations. Eg after 10KK sent TASKSTATS_CMD_ATTR_REGISTER_CPUMASKs ~300 Mb of kernel memory is stolen for the handlers chain and "time id" shows 2-7 seconds instead of normal 0.003. It makes it possible to exhaust all kernel memory and to eat much of CPU time by triggerring numerous exits on a single CPU. The patch limits the number of times a single process may register itself on a single CPU to one. One little issue is kept unfixed - as taskstats_exit() is called before exit_files() in do_exit(), the orphaned listener entry (if it was not explicitly deregistered) is kept until the next someone's exit() and implicit deregistration in send_cpu_listeners(). So, if a process registered itself as a listener exits and the next spawned process gets the same pid, it would inherit taskstats attributes. Signed-off-by: Vasiliy Kulikov Cc: Balbir Singh Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds (backported from commit 26c4caea9d697043cc5a458b96411b86d7f6babd) CVE-2011-2484 BugLink: http://bugs.launchpad.net/bugs/806390 Signed-off-by: Andy Whitcroft --- kernel/taskstats.c | 15 ++++++++++++--- 1 files changed, 12 insertions(+), 3 deletions(-) diff --git a/kernel/taskstats.c b/kernel/taskstats.c index 07e86a8..99e20d1 100644 --- a/kernel/taskstats.c +++ b/kernel/taskstats.c @@ -293,17 +293,19 @@ ret: static int add_del_listener(pid_t pid, cpumask_t *maskp, int isadd) { struct listener_list *listeners; - struct listener *s, *tmp; + struct listener *s, *tmp, *s2; unsigned int cpu; cpumask_t mask = *maskp; if (!cpus_subset(mask, cpu_possible_map)) return -EINVAL; + s = NULL; if (isadd == REGISTER) { for_each_cpu_mask(cpu, mask) { - s = kmalloc_node(sizeof(struct listener), GFP_KERNEL, - cpu_to_node(cpu)); + if (!s) + s = kmalloc_node(sizeof(struct listener), + GFP_KERNEL, cpu_to_node(cpu)); if (!s) goto cleanup; s->pid = pid; @@ -312,9 +314,16 @@ static int add_del_listener(pid_t pid, cpumask_t *maskp, int isadd) listeners = &per_cpu(listener_array, cpu); down_write(&listeners->sem); + list_for_each_entry_safe(s2, tmp, &listeners->list, list) { + if (s2->pid == pid) + goto next_cpu; + } list_add(&s->list, &listeners->list); + s = NULL; +next_cpu: up_write(&listeners->sem); } + kfree(s); return 0; }