From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 37A67802A5 for ; Fri, 9 Oct 2026 14:02:01 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 699E0kIs008363; Fri, 9 Oct 2026 17:00:47 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 699E0kIs008363 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="bDO0r6TV" Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 699E0Sta008337 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Fri, 9 Oct 2026 17:00:29 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 699E0Sta008337 Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-3a7fa5e0442so8037864a91.0 for ; Fri, 09 Oct 2026 07:00:29 -0700 (PDT) X-Gm-Message-State: AFq9FYJzHfPDtzD8n/utLl3WHlGbr0f/a8Ip8RgNO1uqC0FosYzUnEwt DsGE+Im04V6+e2M1WZsNR+d6dvPIy4Xv6/L56TooWR+e5+QN6KFkQNmYaAX3j8Z9QdncLKGsDkf 3nXaxS6IFhQf/5eB6aqytS8UB4BPyeh2IhnFUi6JetxD9mf94Gr1Cyw== X-Gm-Gg: AYBFou3pwVI6pWULnAIdO1dBuDwfjE2s88U4FBqhMmTpaOxtyzfYSabBIwXt9lEW1QK 29ILRyRxIyT/rywCJ/VAToex6Q9wNAmyl1XQlfJ+7ysS3A6rLJPN3FKQdqR3x8eT1AWwIfXFKmT c0zL9UOJ1on5SQY6ROpm/tr7kEZjGUi/b08V0UA9JANJ38hrXFIfP7+s/+t2wignOTA7RZsWlAQ fYdYxn9rxp5PE3g2Qe+7/uqYGPwfVF6PbvVUDUDb8oq43UP77/0GDzmG6uIEkziY7PVZS6ehVQ7 ++DxAcEDk2JlnXOLNhkB1FtpX4NcXVS7fRqpKEanWTE5v8krJWYDDVg5lFHDQbNuF5KR4qXn1op M/HeU2ii88tMiBF9o7P1VVWZh4bmiVAKa3DMqPKjg5e3ggwsSQVg4rPNJedKQ/OyDRTFSKOxsgp bR4qucJKY2raZfv48w8ipksXgp+dGV5VM= X-Received: by 2002:a17:90b:2801:b0:3a0:f2c8:9ad6 with SMTP id 98e67ed59e1d1-3ab3acfe040mr2025521a91.64.1791554427632; Fri, 09 Oct 2026 07:00:27 -0700 (PDT) X-Received: by 2002:a17:90b:2801:b0:3a0:f2c8:9ad6 with SMTP id 98e67ed59e1d1-3ab3acfe040mr2025047a91.64.1791554421218; Fri, 09 Oct 2026 07:00:21 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1791554421; cv=pass; d=google.com; s=arc-20260327; b=Te2VXZZUUBsmyGfHdVfbzK1F2eelzenhHOT15wkOEjQnF914GFziCSAdWAka1TAgUz jj6viBRR1rkgLE3adwj4ALCJTaWtEu9gVTCvVf7S+lcv1XO+S3pwEvsDtGVmU9BsB1Kn zXG5HOmxA1JrrOJ2sIwkdwzaoKAW5IY0F9eKHkz2xMLovN2ojG38Rzq+f9Bd/NoKnJRi ZTo0C2JcfsToMy5C0WQQ2QP2BgBDcEofLfg69x3ipCyJFXJSnPQWHiiEVVllXn7O2LIy wFS9jew5vewLVfzvLHaRsAxCZtEhxLLPs/o481spS6MIfviX+ET15inrvtAwt6ZZOqfn RWTA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:cc:to:in-reply-to:references:message-id :content-transfer-encoding:subject:date:from:dkim-signature; bh=4qtUSAoBDXgbQaTxK+2ZnjaDaMujVqBPxusJXjicY2o=; fh=QMK9nbJ5AYrM+hiPA/q5PkyEnWxrtaWE6qYGnw4J4RA=; b=WZcYjUzPL8NIUO1vpHoHr/MSl+ATDFheT3rVP6fcL0VWs4otAiiySZ+cskLP5pP+6K TSNcoiMtV4sZwVrw6YLk/V2m93lOgnj2Jadt+vwD26qNMyTGR6SAbWPgRa/fpJcl7C55 iX6kSCDZMS/okTe5jQx6z9m9s3JKaLAw2rgp1/95n/S6d8hxW0m4AbgfSepD7gjcMg5Q Oigbrxxuo2cNlHzZ70dyWxQPyB76/3JWZIV2HP9FWt8xkE1A/sPHtBMSwElvJGDnq9nE gn4mwnI9TGekZQ1wIJbZc7h/VdGCi3liTHlfU/sLFHyvDFhLlrpuHLTkt4w/PHc3UrtQ drEw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=bDO0r6TV; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of andrey.drobyshev@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=andrey.drobyshev@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazlp170100001.outbound.protection.outlook.com. [2a01:111:f403:c201::1]) by mx.google.com with ESMTPS id 41be03b00d2f7-cd3da079de5si3637768a12.252.2026.10.09.07.00.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 09 Oct 2026 07:00:21 -0700 (PDT) Received-SPF: pass (google.com: domain of andrey.drobyshev@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) client-ip=2a01:111:f403:c201::1; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=bDO0r6TV; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of andrey.drobyshev@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=andrey.drobyshev@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rUPWiXDblw5Hc4wir20qbtO8VMHgqSdY+mb/07IlTY4KkwRymMnvVIciYW84czTp5P5DFRzPUbzHcrICzPiLCINQ3bl4igrnpswTeEK59ak9t+tVsU4gN0wqmP0xjZQBaxO6CsOfqyNtj42AAgnmA207grj2cgaU2/EicAq2/d9pkj8N0v11rB9J+LgW304sk4m6kMeln1Rp80A/fHnRSCyEYCQdGSUYr8OZcQjbK8toQudL4bOieE22PnzuZzibaQ2cBupLLKPbfXswbBy5svdiuVzoPzHcAWzKFI4ozKzBlmoBplmNdMmusc2ZzJklJPqxUUVDFKek/xFE4TgFkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=4qtUSAoBDXgbQaTxK+2ZnjaDaMujVqBPxusJXjicY2o=; b=ZCNAoDt+vUDe3jrM+lQjdQQ8hARkSfscHGL/9APOTvFQOlrXtvQEVXxWKXFODNXKJc4V9wujNbQeGrLSYyEVPFWKNFW5bH3OtovTI8VmInJ7NGBuB4OyUo3gIIvEunoCptTxGuKJa931L62TgVhWrSVb46TdwDd9DXOhNcD81MX1LsRnmozrxsQT21AY5WaEGg14VJ4NwYUjk8bLWiv59OybgwI+o96xKwMdKC9aP8WBRVpMY/FvRWhd8dxJo9Zboa/tepdlhAG5aZftMHn0kw7wVM3MGZRxjAgQRQKta06sUFexLbvZ3Hrvu+Z1KDslTiLTKEDwOG7myGTO8v2SMg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4qtUSAoBDXgbQaTxK+2ZnjaDaMujVqBPxusJXjicY2o=; b=bDO0r6TVSJb+KpB6SgALLgmLkAGu9215PAdneXfQyz7L8bYLopU7keYZUAIktEyM9/tRvPZgIF7ZwjFY8oOJMRT+brKbWVdi4e5VBdbhOUSNT+9kD5IZrQx77IsJw6sfdT5mXOvi4Q03E8RsZwkmFQDTHUTLB+KoiArG5VWHaVRYDGd4HAQ1Ntzj/G4CcMPHxPpSLFif107RZFdItt7uNhlQE1wxjhcKsrr4AVIsGY578w6aX1cVwb0wYKYXqcSpG1KehL8LG4ofNffNdclulxbBcPZE9lxbpWvzwipMDbOCaSq+WNwgloL9NU5ZaCNpUjFS6atBBz0RzYHfUIQKgA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by PR3PR08MB5802.eurprd08.prod.outlook.com (2603:10a6:102:8a::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.15; Fri, 9 Oct 2026 14:00:16 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0496.010; Fri, 9 Oct 2026 14:00:16 +0000 From: Andrey Drobyshev Date: Fri, 09 Oct 2026 17:00:05 +0300 Message-Id: <20261009-vfio_v1-v1-2-1901cd6c3c74@virtuozzo.com> References: <20261009-vfio_v1-v1-0-1901cd6c3c74@virtuozzo.com> In-Reply-To: <20261009-vfio_v1-v1-0-1901cd6c3c74@virtuozzo.com> To: Konstantin Khorenko X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI6PEPF0000022A.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::8e6) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|PR3PR08MB5802:EE_ X-MS-Office365-Filtering-Correlation-Id: 152ec559-e634-4adf-c3a4-08df260da4f2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|52116014|366016|1800799024|376014|23010399003|6133799003|22082099003|18002099003|10067099003|38350700014|56012099006; X-Microsoft-Antispam-Message-Info: MIsB+B8nyAuXuPxj1KdoW9cin8zs3+6HmfS0RUJJrl3AnnbJAdqyMQOdcBYEQyibv2oxwWvbQjC0sF6DfFuVIx4CozztYZGTgWSZn1HfKaKTwrNiInRecwlmW8+85+yQDQFAfjMt/3jnb+iUFUpNH2yn/tbtTRmUwzvpKe1ttVMZS7C0PprMaSrEXJaU/zEkY37v4ht/aaeQ8aL43gEnM1lrYDEfGQX4bJlOiQ0yGbj80cGuzUxDO1h2s1+Yy6VvHjyAPIIf73+X9747VPTOEgyqrpl6UWDyUQmK6/HYOCaw5Ndm80XWlrxUhKwcWM4lQ4kVsrbEUBmnYi8shegy2/GmibVbx1F6t6YxJI8bp5iVL6MzPQIC+X+U+qJLiPmTO338BMKDTk64sF7G7P5Q+zckl75b3scCJv9rLwo6bsWXKXzZPu2EP98Obg/3J/aY8TWzspzYJxnUTLAyCELT9zHFrCQOmL+nV5Y9uVzynZl8nmacErtW9NSfUGQdb9M3IXEXgglSD4uP9w0MqVcDwYC0rJkTc9W4q26dPfrJh10jO9dYATlHpnE0h+JCUZKRZ/rJjjPn2uOsyCPNq8DVgeU5lWYv1RANKmc5mtoGt8TAU8MDKsVbUcx0UPRSUBm5fUHXEPtC4RKWsuD9Yc05WZwjL8O3RlEIIvUWu3VG/2uMpza6v+cmmZlwGzV828wEV4MvaaPP+Zq9hKtEpaTbHal/ZnEcbK018X/IFk16ofs= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:VI0PR08MB10656.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(52116014)(366016)(1800799024)(376014)(23010399003)(6133799003)(22082099003)(18002099003)(10067099003)(38350700014)(56012099006); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?U3hwT3VSQ052emkwZ2I3RkVBMk0yc2YvQWFDV3JaZzlZbDRuWkxPZWdTKzVF?= =?utf-8?B?QmN1RUR2dFNEMVJUR2dzVG4xcG02dXFNVGRPQnF6b2M3WVNKbXVOL3Z1UFQv?= =?utf-8?B?S3JuSGV2cUVzSWRGcnJaQnNVZE90azRpSUdoanFVN0xxK3hlT1ZzNWszT0pH?= =?utf-8?B?QU9YL0ZnQ1FpK0k0Sm93Smo5WDkvY3hETmoydk1CMWdVU0RQK1RSa2xZTXNS?= =?utf-8?B?eGtGbnh5QURzdjU0dEJ0YkpjakNQa1ZVNUJxTXk5MnkwSWo1TnVDb3pCby9J?= =?utf-8?B?RnA5QTZ3VGVMaVpOSm94VklSQUtNK3Z0UFBOekplRTdmU2xXQ0pCNHRwM0dW?= =?utf-8?B?WUNiLzA4WmZ2YzVKWEhFS0pRZm4xeHhmekVTRVVsYmFPZVdkZVNndWc2S2VH?= =?utf-8?B?eTkxa1V1R081WDM5RGkxNFl1ZUpDNEdrSmZndVdaMUNLQk4wYUJZaURhOE8w?= =?utf-8?B?ZHlFOHRLbXNIRGxadzVQbmpORGpRSkZzQ2U4VHlSLzI4SzVON0Exa3F0Vkti?= =?utf-8?B?QVA0cFZ2UnVCUjRFRzJuSU54aFhaSjd0MGZ5UDc4K3c5NkpBbGlVNjhLTVVZ?= =?utf-8?B?MmY2K3d2anZlbGp6Mkhwb0RmS2plRVNMdHVKc25rU3FYejIybVQrSno1M1Jv?= =?utf-8?B?UEFOelZxcjJsOTExY0srazdGdzZ0VGRlK1JUQU15dnRNNytPSzBaNnZvSEJn?= =?utf-8?B?eExBVFhLVjZrc3hxRUtoeUY4K1l6VmtEUEVleFdRTW55RUZQQzJPc3BBeXVa?= =?utf-8?B?QThxK01IM2VuajZZT1AwS2NKWWwrek1rbm1QUjZkcVhQZ3lvSHBpb0dtMVhx?= =?utf-8?B?Z3hrREdFOCt0Zmg4RjlaQTUvdWxPcHFqOUNsTlAxTXFVNm5jMG1uSzBvUTJD?= =?utf-8?B?ODlRUFZvVUhMc0hOM09KUXlFbld6MEFHejNuYU1zc0JVODFJQ3pZQnlUU3hT?= =?utf-8?B?TDI0Y2RBRndqeVdROFI4ZzV4c1EwMmtnTUNqbkI4VFpCU0tVaXdycWx2Zmhn?= =?utf-8?B?OFB3dGRvcFBKZDZhT0VLWTdTcHVUS2lKdVQ4RUdxVDJpdnhSNnlTS3NzYlM4?= =?utf-8?B?cWJVekZIMFJlTFJuWnRIQ3JhNmtIQkNMdnV3RzI5VWdJTjVWd3VLZlRvOXRR?= =?utf-8?B?bEhNcnlEWEV4QmxkRXNVbHYrcjd6TTVzWGxTbmtjdEcrY1FCN3MxMXo2QWxY?= =?utf-8?B?K3dEczBXNlFDUDZOZUh2UHZOdkdBR3pqSEswQU9XWndLdGhvZWJrZ2lZZERl?= =?utf-8?B?d093bTRqKzZGYVk4dCtPSFRsTkRoZm5LN01mRmtvNFg0VXg0OUpsdzhQNzlQ?= =?utf-8?B?VWtLN2NKbFFEa1dpM1JqODJvc21odWlGT2NremcxcFpQL3p3eFdUTVFncWto?= =?utf-8?B?OHgwRU52TGZseUM2Qk9RNzFGVXJFeHdWQisrbG1yS0VPY2lrUWN0R21QTzAx?= =?utf-8?B?VWNUZ0hVOE83RGVVeHVkZTBXY1FSQzE4TkczNTh2QXRWSUt3dWRmUEJVYVVZ?= =?utf-8?B?OFF5bk9IeEluZDlOc0Uyd1FtalgvanI2UXVZTkFIb2xaSjdqVGkrMjl6Y2Ni?= =?utf-8?B?ZWxORUkxK0QrS01mRDRHQ0dDK0orQ2JLTTNDQ09DZmpQSUVuUGJsUTNmdzJB?= =?utf-8?B?YlFsQ1FNS1hrRkFWOUxsaytNK083SGR6RmlJeDdUQVoyZ2lQelRKWEdIc2xU?= =?utf-8?B?RXRqYnVIUm50OGFCZFNKVDJSbEd2bXZuY2tBaEhqODlVcWVCUUdlQTN6ZE5L?= =?utf-8?B?Q2N2bCt4QTVTZkk2REhDSFJObysrdDJtUWQvaGM4NVlFUmlsUjNNeDJDdVdW?= =?utf-8?B?TTJlZ3E1cnEwSVpMODdiQ2o3MXlqZUpvb3BZc0VIVmdYSE1RMWluanBsMFN0?= =?utf-8?B?a0RSM1E3ZmJUSGxlbW9CUjVUajM4ZzVpTnYyVWdzRjBKYUNHYzJZVnA4K0Z4?= =?utf-8?B?aE56WEJQRTIxM1ptRUFzdEpaalFFZ29CRzJNWDJGSXZqTHdXbk9pZzhsMjZs?= =?utf-8?B?T0lTSnE0M3pEOEpPVG45NWZuVjRhd3dZOGJzMk84OVhDc2gyVUZTRSsrcC9P?= =?utf-8?B?aktjbEJzY0FKdGw5Wk92TzRGcG1Tay9hNGppZG56bEZMWldyZ2xTeG5NTUZM?= =?utf-8?B?d2NKRFAxV21WQ2RRT1JudVNza25ZdjhCajlwMDR6bUR1Mnh0d3VSY0gyckpk?= =?utf-8?B?SStnaiszcjM2WlVMc044dk1hRW5henRDUE5vUUx1UzJMeWdZNXZhL0xwMUdt?= =?utf-8?B?bnZwaWZ0YzBWVGhEODJKVStJZEpGQmh4dDRaM3lxSnZyQi96YnRqYUUzYXNq?= =?utf-8?B?VWt3eFdrV2xrUUJlOEV2Tm05RHZrRml4djhzNXF5ZHpDaDJJd2hxVDc4RWNa?= =?utf-8?Q?od5Qsv0pdyuj8lKg=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 152ec559-e634-4adf-c3a4-08df260da4f2 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2026 14:00:15.5084 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: CkZmJMf9h+dcdL6NilI5f21D1GAuE3LusQKogU+pWlaVNZeWEaXaI5D4GY47fumeRU11IOOTxF4u0fp6TmTzVESij/oqAZPUWmrcGgs7+xg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3PR08MB5802 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH RFC PATCH hci-8.1 2/4] exec: protect preserved memory against surviving shared-mm tasks X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org Reserve the marked mm before exec becomes irreversible. Reject tasks outside the execing thread group while allowing inspection references and sibling threads that de_thread will remove. Track CLONE_VM creations from copy_mm until publication or failure so admission cannot miss an unpublished task. Reject new shared-mm clones while the reservation is held, and release it on mm switch or exec failure. Use kABI reserve slots and a spare binprm bit to preserve existing layouts. https://virtuozzo.atlassian.net/browse/VSTOR-103860 Signed-off-by: Andrey Drobyshev --- fs/exec.c | 88 +++++++++++++++++++++++++++++++++++++++++++++--- include/linux/binfmts.h | 2 ++ include/linux/mm_types.h | 5 +-- kernel/fork.c | 34 +++++++++++++++++++ 4 files changed, 122 insertions(+), 7 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index e861a54b491f..5b2f9c3b0d06 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -978,6 +978,79 @@ ssize_t read_code(struct file *file, unsigned long addr, loff_t pos, size_t len) EXPORT_SYMBOL(read_code); #endif +/* The reservation owns no mm reference; release it before dropping old_mm. */ +static void release_preserved_mem(struct linux_binprm *bprm, struct mm_struct *mm) +{ + if (!bprm->preserving_mem) + return; + spin_lock(&mm->page_table_lock); + mm->exec_keep_active = false; + spin_unlock(&mm->page_table_lock); + bprm->preserving_mem = false; +} + +/* + * Reserve the marked address space before exec becomes irreversible. + * Inspection references do not constitute shared execution: mmap_lock + * serializes those readers with the mapping transfer. Only tasks outside + * our group survive de_thread() and must be rejected here. + */ +static int reserve_preserved_mem(struct linux_binprm *bprm) +{ + struct mm_struct *mm = current->mm; + struct vm_area_struct *vma; + struct task_struct *p, *t; + bool preserve = false; + int ret = 0; + + if (!bprm->accepts_preserved_mem || !mm) + return 0; + + if (mmap_read_lock_killable(mm)) + return -EINTR; + { + VMA_ITERATOR(vmi, mm, 0); + + for_each_vma(vmi, vma) { + if (vma->vm_flags & VM_EXEC_KEEP) { + preserve = true; + break; + } + } + } + mmap_read_unlock(mm); + if (!preserve) + return 0; + + /* A clone is either counted here or already visible in the task list. */ + spin_lock(&mm->page_table_lock); + if (mm->exec_keep_active || mm->exec_keep_clones) + ret = -EBUSY; + else + mm->exec_keep_active = true; + spin_unlock(&mm->page_table_lock); + if (ret) + return ret; + bprm->preserving_mem = true; + + read_lock(&tasklist_lock); + for_each_process_thread(p, t) { + if (same_thread_group(current, t)) + continue; + task_lock(t); + if (t->mm == mm) + ret = -EBUSY; + task_unlock(t); + if (ret) + goto out; + } +out: + read_unlock(&tasklist_lock); + if (ret) + release_preserved_mem(bprm, mm); + return ret; +} + static int vma_dup_some(struct mm_struct *old_mm, struct mm_struct *new_mm) { struct vm_area_struct *vma; @@ -1028,7 +1101,7 @@ static int exec_mmap(struct linux_binprm *bprm) up_write(&tsk->signal->exec_update_lock); return ret; } - if (bprm->accepts_preserved_mem) { + if (bprm->preserving_mem) { ret = vma_dup_some(old_mm, mm); if (ret) { mmap_read_unlock(old_mm); @@ -1067,6 +1140,7 @@ static int exec_mmap(struct linux_binprm *bprm) BUG_ON(active_mm != old_mm); setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm); mm_update_next_owner(old_mm); + release_preserved_mem(bprm, old_mm); mmput(old_mm); return 0; } @@ -1260,10 +1334,9 @@ void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec) } /* - * Calling this is the point of no return. None of the failures will be - * seen by userspace since either the process is already taking a fatal - * signal (via de_thread() or coredump), or will have SEGV raised - * (after exec_mmap()) by search_binary_handler (see below). + * Complete the recoverable checks before setting point_of_no_return. + * Subsequent failures cannot return to the old image: either a fatal + * signal is already pending, or bprm_execve() raises SIGSEGV. */ int begin_new_exec(struct linux_binprm * bprm) { @@ -1275,6 +1348,10 @@ int begin_new_exec(struct linux_binprm * bprm) if (retval) return retval; + retval = reserve_preserved_mem(bprm); + if (retval) + return retval; + /* * This tracepoint marks the point before flushing the old exec where * the current task is still unchanged, but errors are fatal (point of @@ -1527,6 +1604,7 @@ static void do_close_execat(struct file *file) static void free_bprm(struct linux_binprm *bprm) { + release_preserved_mem(bprm, current->mm); if (bprm->mm) { acct_arg_size(bprm, 0); mmput(bprm->mm); diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h index 9f03c39498e9..7c4defdc184f 100644 --- a/include/linux/binfmts.h +++ b/include/linux/binfmts.h @@ -51,6 +51,8 @@ struct linux_binprm { #ifdef __alpha__ unsigned int taso:1; #endif + /* Uses spare bits without changing the existing binprm layout. */ + RH_KABI_EXCLUDE(unsigned int preserving_mem:1) struct file *executable; /* Executable to pass to the interpreter */ struct file *interpreter; struct file *file; diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index cf50c74516b0..0a74c377f64c 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -1091,8 +1091,9 @@ struct mm_struct { } lru_gen; #endif /* CONFIG_LRU_GEN_WALKS_MMU */ } __randomize_layout; - RH_KABI_RESERVE(1) - RH_KABI_RESERVE(2) + /* Shared-mm clone publication, serialized by page_table_lock. */ + RH_KABI_USE(1, unsigned int exec_keep_clones) + RH_KABI_USE(2, bool exec_keep_active) RH_KABI_RESERVE(3) RH_KABI_RESERVE(4) /* diff --git a/kernel/fork.c b/kernel/fork.c index 00d9b4febd85..bd8020af2037 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1270,6 +1270,8 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, mt_init_flags(&mm->mm_mt, MM_MT_FLAGS); mt_set_external_lock(&mm->mm_mt, &mm->mmap_lock); atomic_set(&mm->mm_users, 1); + mm->exec_keep_clones = 0; + mm->exec_keep_active = false; atomic_set(&mm->mm_count, 1); seqcount_init(&mm->write_protect_seq); mmap_init_lock(mm); @@ -1710,9 +1712,32 @@ static struct mm_struct *dup_mm(struct task_struct *tsk, return NULL; } +/* Keep unpublished CLONE_VM tasks visible to preserving-exec admission. */ +static int exec_keep_clone_begin(struct mm_struct *mm) +{ + int ret = 0; + + spin_lock(&mm->page_table_lock); + if (mm->exec_keep_active) + ret = -EBUSY; + else + mm->exec_keep_clones++; + spin_unlock(&mm->page_table_lock); + return ret; +} + +static void exec_keep_clone_end(struct mm_struct *mm) +{ + spin_lock(&mm->page_table_lock); + if (!WARN_ON_ONCE(!mm->exec_keep_clones)) + mm->exec_keep_clones--; + spin_unlock(&mm->page_table_lock); +} + static int copy_mm(unsigned long clone_flags, struct task_struct *tsk) { struct mm_struct *mm, *oldmm; + int ret; tsk->min_flt = tsk->maj_flt = 0; tsk->nvcsw = tsk->nivcsw = 0; @@ -1734,6 +1759,9 @@ static int copy_mm(unsigned long clone_flags, struct task_struct *tsk) return 0; if (clone_flags & CLONE_VM) { + ret = exec_keep_clone_begin(oldmm); + if (ret) + return ret; mmget(oldmm); mm = oldmm; } else { @@ -2638,6 +2666,10 @@ __latent_entropy struct task_struct *copy_process( syscall_tracepoint_update(p); write_unlock_irq(&tasklist_lock); + /* Admission can now find this shared-mm task in the task list. */ + if ((clone_flags & CLONE_VM) && p->mm) + exec_keep_clone_end(p->mm); + if (pidfile) fd_install(pidfd, pidfile); @@ -2679,6 +2711,8 @@ __latent_entropy struct task_struct *copy_process( exit_ve_namespace(p); bad_fork_cleanup_mm: if (p->mm) { + if (clone_flags & CLONE_VM) + exec_keep_clone_end(p->mm); mm_clear_owner(p->mm, p); mmput(p->mm); } -- 2.47.1 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel