--- /dev/null
+From 8fb335e078378c8426fabeed1ebee1fbf915690c Mon Sep 17 00:00:00 2001
+From: Andrei Vagin <avagin@gmail.com>
+Date: Fri, 1 Feb 2019 14:20:24 -0800
+Subject: kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
+
+From: Andrei Vagin <avagin@gmail.com>
+
+commit 8fb335e078378c8426fabeed1ebee1fbf915690c upstream.
+
+Currently, exit_ptrace() adds all ptraced tasks in a dead list, then
+zap_pid_ns_processes() waits on all tasks in a current pidns, and only
+then are tasks from the dead list released.
+
+zap_pid_ns_processes() can get stuck on waiting tasks from the dead
+list. In this case, we will have one unkillable process with one or
+more dead children.
+
+Thanks to Oleg for the advice to release tasks in find_child_reaper().
+
+Link: http://lkml.kernel.org/r/20190110175200.12442-1-avagin@gmail.com
+Fixes: 7c8bd2322c7f ("exit: ptrace: shift "reap dead" code from exit_ptrace() to forget_original_parent()")
+Signed-off-by: Andrei Vagin <avagin@gmail.com>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/exit.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -450,12 +450,14 @@ static struct task_struct *find_alive_th
+ return NULL;
+ }
+
+-static struct task_struct *find_child_reaper(struct task_struct *father)
++static struct task_struct *find_child_reaper(struct task_struct *father,
++ struct list_head *dead)
+ __releases(&tasklist_lock)
+ __acquires(&tasklist_lock)
+ {
+ struct pid_namespace *pid_ns = task_active_pid_ns(father);
+ struct task_struct *reaper = pid_ns->child_reaper;
++ struct task_struct *p, *n;
+
+ if (likely(reaper != father))
+ return reaper;
+@@ -471,6 +473,12 @@ static struct task_struct *find_child_re
+ panic("Attempted to kill init! exitcode=0x%08x\n",
+ father->signal->group_exit_code ?: father->exit_code);
+ }
++
++ list_for_each_entry_safe(p, n, dead, ptrace_entry) {
++ list_del_init(&p->ptrace_entry);
++ release_task(p);
++ }
++
+ zap_pid_ns_processes(pid_ns);
+ write_lock_irq(&tasklist_lock);
+
+@@ -557,7 +565,7 @@ static void forget_original_parent(struc
+ exit_ptrace(father, dead);
+
+ /* Can drop and reacquire tasklist_lock */
+- reaper = find_child_reaper(father);
++ reaper = find_child_reaper(father, dead);
+ if (list_empty(&father->children))
+ return;
+
--- /dev/null
+From cefc7ef3c87d02fc9307835868ff721ea12cc597 Mon Sep 17 00:00:00 2001
+From: Shakeel Butt <shakeelb@google.com>
+Date: Fri, 1 Feb 2019 14:20:54 -0800
+Subject: mm, oom: fix use-after-free in oom_kill_process
+
+From: Shakeel Butt <shakeelb@google.com>
+
+commit cefc7ef3c87d02fc9307835868ff721ea12cc597 upstream.
+
+Syzbot instance running on upstream kernel found a use-after-free bug in
+oom_kill_process. On further inspection it seems like the process
+selected to be oom-killed has exited even before reaching
+read_lock(&tasklist_lock) in oom_kill_process(). More specifically the
+tsk->usage is 1 which is due to get_task_struct() in oom_evaluate_task()
+and the put_task_struct within for_each_thread() frees the tsk and
+for_each_thread() tries to access the tsk. The easiest fix is to do
+get/put across the for_each_thread() on the selected task.
+
+Now the next question is should we continue with the oom-kill as the
+previously selected task has exited? However before adding more
+complexity and heuristics, let's answer why we even look at the children
+of oom-kill selected task? The select_bad_process() has already selected
+the worst process in the system/memcg. Due to race, the selected
+process might not be the worst at the kill time but does that matter?
+The userspace can use the oom_score_adj interface to prefer children to
+be killed before the parent. I looked at the history but it seems like
+this is there before git history.
+
+Link: http://lkml.kernel.org/r/20190121215850.221745-1-shakeelb@google.com
+Reported-by: syzbot+7fbbfa368521945f0e3d@syzkaller.appspotmail.com
+Fixes: 6b0c81b3be11 ("mm, oom: reduce dependency on tasklist_lock")
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/oom_kill.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -544,6 +544,13 @@ void oom_kill_process(struct oom_control
+ * still freeing memory.
+ */
+ read_lock(&tasklist_lock);
++
++ /*
++ * The task 'p' might have already exited before reaching here. The
++ * put_task_struct() will free task_struct 'p' while the loop still try
++ * to access the field of 'p', so, get an extra reference.
++ */
++ get_task_struct(p);
+ for_each_thread(p, t) {
+ list_for_each_entry(child, &t->children, sibling) {
+ unsigned int child_points;
+@@ -563,6 +570,7 @@ void oom_kill_process(struct oom_control
+ }
+ }
+ }
++ put_task_struct(p);
+ read_unlock(&tasklist_lock);
+
+ p = find_lock_task_mm(victim);
platform-x86-asus-nb-wmi-map-0x35-to-key_screenlock.patch
platform-x86-asus-nb-wmi-drop-mapping-of-0x33-and-0x.patch
mmc-sdhci-iproc-handle-mmc_of_parse-errors-during-probe.patch
+kernel-exit.c-release-ptraced-tasks-before-zap_pid_ns_processes.patch
+mm-oom-fix-use-after-free-in-oom_kill_process.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
