fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats

commit 7601df8031fd67310af891897ef6cc0df4209305 upstream.

lock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call
do_task_stat() at the same time and the process has NR_THREADS, it will
spin with irqs disabled O(NR_CPUS * NR_THREADS) time.

Change do_task_stat() to use sig->stats_lock to gather the statistics
outside of ->siglock protected section, in the likely case this code will
run lockless.

Link: https://lkml.kernel.org/r/20240123153357.GA21857@redhat.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Dylan Hatch <dylanbhatch@google.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: David Sauerwein <dssauerw@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/proc/array.c b/fs/proc/array.c
index 18a4588c35be632449258c2fc5d0e6f4ccd5effd..8fba6d39e776fde22d7bd81bdcd733a677e96676 100644 (file)
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -443,12 +443,12 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
        int permitted;
        struct mm_struct *mm;
        unsigned long long start_time;
-       unsigned long cmin_flt = 0, cmaj_flt = 0;
-       unsigned long  min_flt = 0,  maj_flt = 0;
-       u64 cutime, cstime, utime, stime;
-       u64 cgtime, gtime;
+       unsigned long cmin_flt, cmaj_flt, min_flt, maj_flt;
+       u64 cutime, cstime, cgtime, utime, stime, gtime;
        unsigned long rsslim = 0;
        unsigned long flags;
+       struct signal_struct *sig = task->signal;
+       unsigned int seq = 1;
 
        state = *get_task_state(task);
        vsize = eip = esp = 0;
@@ -476,12 +476,9 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
 
        sigemptyset(&sigign);
        sigemptyset(&sigcatch);
-       cutime = cstime = utime = stime = 0;
-       cgtime = gtime = 0;
+       utime = stime = 0;
 
        if (lock_task_sighand(task, &flags)) {
-               struct signal_struct *sig = task->signal;
-
                if (sig->tty) {
                        struct pid *pgrp = tty_get_pgrp(sig->tty);
                        tty_pgrp = pid_nr_ns(pgrp, ns);
@@ -492,37 +489,48 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                num_threads = get_nr_threads(task);
                collect_sigign_sigcatch(task, &sigign, &sigcatch);
 
+               rsslim = READ_ONCE(sig->rlim[RLIMIT_RSS].rlim_cur);
+
+               sid = task_session_nr_ns(task, ns);
+               ppid = task_tgid_nr_ns(task->real_parent, ns);
+               pgid = task_pgrp_nr_ns(task, ns);
+
+               unlock_task_sighand(task, &flags);
+       }
+
+       if (permitted && (!whole || num_threads < 2))
+               wchan = get_wchan(task);
+
+       do {
+               seq++; /* 2 on the 1st/lockless path, otherwise odd */
+               flags = read_seqbegin_or_lock_irqsave(&sig->stats_lock, &seq);
+
                cmin_flt = sig->cmin_flt;
                cmaj_flt = sig->cmaj_flt;
                cutime = sig->cutime;
                cstime = sig->cstime;
                cgtime = sig->cgtime;
-               rsslim = READ_ONCE(sig->rlim[RLIMIT_RSS].rlim_cur);
 
-               /* add up live thread stats at the group level */
                if (whole) {
                        struct task_struct *t = task;
+
+                       min_flt = sig->min_flt;
+                       maj_flt = sig->maj_flt;
+                       gtime = sig->gtime;
+
+                       rcu_read_lock();
                        do {
                                min_flt += t->min_flt;
                                maj_flt += t->maj_flt;
                                gtime += task_gtime(t);
                        } while_each_thread(task, t);
+                       rcu_read_unlock();
 
-                       min_flt += sig->min_flt;
-                       maj_flt += sig->maj_flt;
                        thread_group_cputime_adjusted(task, &utime, &stime);
-                       gtime += sig->gtime;
                }
+       } while (need_seqretry(&sig->stats_lock, seq));
+       done_seqretry_irqrestore(&sig->stats_lock, seq, flags);
 
-               sid = task_session_nr_ns(task, ns);
-               ppid = task_tgid_nr_ns(task->real_parent, ns);
-               pgid = task_pgrp_nr_ns(task, ns);
-
-               unlock_task_sighand(task, &flags);
-       }
-
-       if (permitted && (!whole || num_threads < 2))
-               wchan = get_wchan(task);
        if (!whole) {
                min_flt = task->min_flt;
                maj_flt = task->maj_flt;