sched, signals: fix the racy usage of ->signal in account_group_xxx/run_posix_cpu_timers

Impact: fix potential NULL dereference

Contrary to ad474caca3e2a0550b7ce0706527ad5ab389a4d4 changelog, other
acct_group_xxx() helpers can be called after exit_notify() by timer tick.
Thanks to Roland for pointing out this. Somehow I missed this simple fact
when I read the original patch, and I am afraid I confused Frank during
the discussion. Sorry.

Fortunately, these helpers work with current, we can check ->exit_state
to ensure that ->signal can't go away under us.

Also, add the comment and compiler barrier to account_group_exec_runtime(),
to make sure we load ->signal only once.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

2 files changed, 16 insertions, 6 deletions

diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 153dcb2639c3..895337b16a24 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -1308,9 +1308,10 @@ static inline int task_cputime_expired(const struct task_cputime *sample,
  */
 static inline int fastpath_timer_check(struct task_struct *tsk)
 {
-        struct signal_struct *sig = tsk->signal;
+        struct signal_struct *sig;
 
-        if (unlikely(!sig))
+        /* tsk == current, ensure it is safe to use ->signal/sighand */
+        if (unlikely(tsk->exit_state))
                 return 0;
 
         if (!task_cputime_zero(&tsk->cputime_expires)) {
@@ -1323,6 +1324,8 @@ static inline int fastpath_timer_check(struct task_struct *tsk)
                 if (task_cputime_expired(&task_sample, &tsk->cputime_expires))
                         return 1;
         }
+
+        sig = tsk->signal;
         if (!task_cputime_zero(&sig->cputime_expires)) {
                 struct task_cputime group_sample;
 
diff --git a/kernel/sched_stats.h b/kernel/sched_stats.h
index ee71bec1da66..7dbf72a2b02c 100644
--- a/kernel/sched_stats.h
+++ b/kernel/sched_stats.h
@@ -298,9 +298,11 @@ static inline void account_group_user_time(struct task_struct *tsk,
 {
         struct signal_struct *sig;
 
-        sig = tsk->signal;
-        if (unlikely(!sig))
+        /* tsk == current, ensure it is safe to use ->signal */
+        if (unlikely(tsk->exit_state))
                 return;
+
+        sig = tsk->signal;
         if (sig->cputime.totals) {
                 struct task_cputime *times;
 
@@ -325,9 +327,11 @@ static inline void account_group_system_time(struct task_struct *tsk,
 {
         struct signal_struct *sig;
 
-        sig = tsk->signal;
-        if (unlikely(!sig))
+        /* tsk == current, ensure it is safe to use ->signal */
+        if (unlikely(tsk->exit_state))
                 return;
+
+        sig = tsk->signal;
         if (sig->cputime.totals) {
                 struct task_cputime *times;
 
@@ -353,8 +357,11 @@ static inline void account_group_exec_runtime(struct task_struct *tsk,
         struct signal_struct *sig;
 
         sig = tsk->signal;
+        /* see __exit_signal()->task_rq_unlock_wait() */
+        barrier();
         if (unlikely(!sig))
                 return;
+
         if (sig->cputime.totals) {
                 struct task_cputime *times;