lkml.org 
[lkml]   [2010]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
Subjectfutex() on vdso makes process unkillable
From
I was experimenting with futexes and was a little surprised to
discover that futex() works on read-only pages. This creates quite a
high bandwidth side channel that allows two processes to communicate
if, for example, they share a library. (Mind you, this is not much
different from file locks, which also work on read-only file
descriptors.)

I also found a couple of differences between 2.6.24 (from Ubuntu
hardy) and 2.6.31 (from Ubuntu karmic). The first is a definite bug
in 2.6.31:


1) On 2.6.31 i686, using futex() on the vdso causes the process to get
stuck, consuming CPU in an unkillable state. Both FUTEX_WAIT and
FUTEX_WAKE cause the problem. The problem doesn't occur on 2.6.24.
(BTW, I was testing to see whether futex() on the vdso allows any two
processes to communicate. This appears not to be the case on 2.6.24.)

A test program is below.


2) Suppose a file is mapped into two processes with MAP_PRIVATE. Can
the resulting mappings be used to communicate via futex()? i.e. Does
futex() consider the mappings to be the same?

On 2.6.24, the futex wakeup is not transferred; pages must be mapped
with MAP_SHARED for futex to work. On 2.6.31, the futex wakeup *is*
transferred; futex works with either MAP_SHARED or MAP_PRIVATE.

2.6.24's behaviour seems more correct, because the mappings are
logically different, even if the underlying memory pages are the same
before copy-on-write is triggered. Is 2.6.31's behaviour a
regression, or is the kernel's behaviour here supposed to be
undefined?

Cheers,
Mark


/* Test futex() on the vdso, which the kernel maps on process startup. */

#include <stdio.h>
#include <stdlib.h>

#include <elf.h>
#include <linux/futex.h>
#include <sys/syscall.h>
#include <unistd.h>


#if __WORDSIZE == 32
# define Elf(name) Elf32_##name
#elif __WORDSIZE == 64
# define Elf(name) Elf64_##name
#endif

void *find_vdso(char **argv)
{
/* Find auxv. */
char **p = argv;
/* Skip past argv. */
while(*p)
p++;
p++;
/* Skip past env. */
while(*p)
p++;
p++;
Elf(auxv_t) *auxv = (void *) p;
for(; auxv->a_type; auxv++)
if(auxv->a_type == AT_SYSINFO_EHDR)
return (void *) auxv->a_un.a_val;
fprintf(stderr, "vdso not found\n");
exit(1);
}

int main(int argc, char **argv)
{
int *vdso = find_vdso(argv);
fprintf(stderr, "vdso found at %p\n", vdso);
if(syscall(__NR_futex, vdso, FUTEX_WAKE, 1) < 0)
perror("futex/WAKE");
if(syscall(__NR_futex, vdso, FUTEX_WAIT, *vdso, NULL) < 0)
perror("futex/WAIT");
return 0;
}


\
 
 \ /
  Last update: 2010-01-24 01:19    [W:0.159 / U:32.080 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site