Merge tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull signal handling updates from Christian Brauner:
 "This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
  restarted and fixes a bunch of coredump and signal bugs.

  TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
  returns to userspace, runs its task work and goes back to sleep. That
  breaks coredumps: dump_interrupted() only lets fatal signals interrupt
  a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
  pipe and the socket paths check signal_pending() Adeep down in code
  that is shared with regular syscalls and bail. So a crashing process
  with io_uring requests in flight loses most of its coredump.

  In the selftest an unfixed kernel delivers 357324 of at least 5111808
  bytes. And io_uring isn't the only source. klp_send_signals(),
  bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
  the printk kunit test raise the bit as well, some of them from irq
  context against any task. So this can't be fixed per subsystem and the
  state has to be per-task and ambient.

  Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
  modelled on memalloc_nofs_save(). Inside such a section
  signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
  path, which hand-rolled its own version of this, and the pid namespace
  reaper, which busy-looped when the bit kept getting raised, are
  converted.

  The second part is a set of fixes that fell out of looking at the
  coredump code with kres and modelling it in TLA+:

  - coredump_finish() woke the parked threads without holding rcu. A
    parked thread can exit on a spurious wakeup and be freed before
    wake_up_process() takes its pi_lock.

  - Only SIGKILL and the freezers interrupt a dump now and the three
    freezers agree. Power management and cgroup v1 freezing aborted a
    dump while a cgroup v2 freeze either waited for the dump or cut it
    short depending on where the core went.

  - io-wq set its exit bit without a barrier against the task work that
    creates workers. On weakly ordered architectures exit could hang on
    worker_done.

  - retarget_shared_pending() slingshotted a shared signal to the dumper
    when a zapped sibling restored its signal mask. That set
    TIF_SIGPENDING on the dumper and truncated the core.

  - A tracer could clear the signal mask of a user worker with
    PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of
    an SQPOLL ring dumping core deadlocks the whole group.
    PTRACE_SETSIGMASK is refused for user workers now and
    __set_task_blocked() enforces the fork-time mask.

  - exec cancels io_uring requests before de_thread() so a worker
    creation queued as task work can't add a thread to a thread group
    that de_thread() just took down.

  - No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
    creator anymore. Such a worker was invisible to zap_process() but
    still decremented threads_remaining on exit so the dumper could
    leave coredump_wait_inactive() early.

  Also included are a comment that do_each_pid_task() needs
  tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
  fork() into a pid namespace whose ancestor lost its init"

* tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits)
  pid: use READ_ONCE() in pid_alive()
  selftests: pid_namespace: test fork with dead ancestor
  pid: document that do_each_pid_task() needs tasklist_lock
  signal: enforce the user worker signal mask in __set_task_blocked()
  fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
  fork: don't create io threads once PF_POSTCOREDUMP is set
  fork: move the coredump and exec checks into create_io_thread()
  exec: cancel io_uring requests before de_thread()
  selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
  selftests/coredump: test a user worker as the coredumping thread
  ptrace: refuse to change the signal mask of a user worker
  selftests/coredump: test shared signal retargeting during a dump
  signal: only SIGKILL and the freezers interrupt a coredumping task
  signal: don't retarget shared signals in a dying thread group
  io-wq: order the exit bit against worker creation task work
  coredump: hold RCU while releasing parked threads
  pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
  smb: prevent TIF_NOTIFY_SIGNAL from interrupting
  selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
  coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
  ...

3 files changed, 36 insertions, 4 deletions

diff --git a/include/linux/pid.h b/include/linux/pid.h
index ddaef0bbc8ba..a0458c713e4e 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -187,6 +187,15 @@ static inline pid_t pid_nr(struct pid *pid)
 pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns);
 pid_t pid_vnr(struct pid *pid);
 
+/*
+ * Needs tasklist_lock if type > PIDTYPE_TGID. A lockless reader can:
+ *
+ * - race with a change_pid() that moves the task to another hlist,
+ *   and continue to scan the wrong list.
+ *
+ * - race with a copy_process() that adds a new task to the start of hlist,
+ *   and miss the new child.
+ */
 #define do_each_pid_task(pid, type, task)				\
 	do {								\
 		if ((pid) != NULL)					\
@@ -264,7 +273,7 @@ static inline pid_t task_tgid_nr(struct task_struct *tsk)
  */
 static inline int pid_alive(const struct task_struct *p)
 {
-	return p->thread_pid != NULL;
+	return READ_ONCE(p->thread_pid) != NULL;
 }
 
 static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d35ae49a991f..78bfc0e32e56 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1817,7 +1817,7 @@ extern struct pid __rcu *cad_pid;
 						 * I am cleaning dirty pages from some other bdi. */
 #define PF_KTHREAD		0x00200000	/* I am a kernel thread */
 #define PF_RANDOMIZE		0x00400000	/* Randomize virtual address space */
-#define PF__HOLE__00800000	0x00800000
+#define PF_NO_NOTIFY_SIGNAL	0x00800000	/* see no_notify_signal_save() */
 #define PF__HOLE__01000000	0x01000000
 #define PF__HOLE__02000000	0x02000000
 #define PF_NO_SETAFFINITY	0x04000000	/* Userland is not allowed to meddle with cpus_mask */
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index efa1e2d6c7a6..bfb84f025b67 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -2,6 +2,7 @@
 #ifndef _LINUX_SCHED_SIGNAL_H
 #define _LINUX_SCHED_SIGNAL_H
 
+#include <linux/cleanup.h>
 #include <linux/rculist.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
@@ -384,14 +385,36 @@ static inline int task_sigpending(struct task_struct *p)
 	return unlikely(test_tsk_thread_flag(p,TIF_SIGPENDING));
 }
 
+/* Prevent TIF_NOTIFY_SIGNAL from interrupting this task. */
+static inline unsigned int no_notify_signal_save(void)
+{
+	unsigned int flags = current->flags;
+
+	current->flags |= PF_NO_NOTIFY_SIGNAL;
+	return flags;
+}
+
+/* Restore the previous PF_NO_NOTIFY_SIGNAL state. */
+static inline void no_notify_signal_restore(unsigned int flags)
+{
+	current_restore_flags(flags, PF_NO_NOTIFY_SIGNAL);
+}
+
+DEFINE_LOCK_GUARD_0(no_notify_signal,
+		    _T->flags = no_notify_signal_save(),
+		    no_notify_signal_restore(_T->flags),
+		    unsigned int flags)
+
 static inline int signal_pending(struct task_struct *p)
 {
 	/*
 	 * TIF_NOTIFY_SIGNAL isn't really a signal, but it requires the same
 	 * behavior in terms of ensuring that we break out of wait loops
-	 * so that notify signal callbacks can be processed.
+	 * so that notify signal callbacks can be processed. Not for a task
+	 * that asked not to be interrupted by it, see no_notify_signal_save().
 	 */
-	if (unlikely(test_tsk_thread_flag(p, TIF_NOTIFY_SIGNAL)))
+	if (unlikely(test_tsk_thread_flag(p, TIF_NOTIFY_SIGNAL)) &&
+	    likely(!(READ_ONCE(p->flags) & PF_NO_NOTIFY_SIGNAL)))
 		return 1;
 	return task_sigpending(p);
 }