Hi Christian,
On 6/11/20 12:02 PM, Christian Brauner wrote:
> Hey,
>
> I'm about to finish a patch to add CLONE_NEWTIME support to setns().
> Since setns() now allows to attach to a multiple namespaces at the same
> time I've also reworked it to be atomic (already upstream). Either all
> namespaces are switched or no namespace is switched. All namespaces
> basically now have a commit mode after which installation should ideally
> not fail anymore. That could work for CLONE_NEWTIME too, I think. The
> only blocker to this is vdso_join_timens() which can fail due to
> mmap_write_lock_killable().
>
> Is it possible to change this to mmap_write_lock()? So sm like:
>
> diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
> index ea7c1f0b79df..5c5b4cc61fce 100644
> --- a/arch/x86/entry/vdso/vma.c
> +++ b/arch/x86/entry/vdso/vma.c
> @@ -144,8 +144,7 @@ int vdso_join_timens(struct task_struct *task, struct
> time_namespace *ns)
> struct mm_struct *mm = task->mm;
> struct vm_area_struct *vma;
>
> - if (mmap_write_lock_killable(mm))
> - return -EINTR;
> + mmap_write_lock(mm);
>
> for (vma = mm->mmap; vma; vma = vma->vm_next) {
> unsigned long size = vma->vm_end - vma->vm_start;
I think, it should be fine.
I'm thinking if it actually could be downgraded to mmap_read_lock()..
Probably, write lock was being over-cautious.
> vdso_join_timens() is called in two places. Once during fork() and once
> during timens_install(). I would only need the mmap_write_lock() change
> for the latter. So alternatively we could have:
>
> __vdso_join_timens_unlocked()
>
> and then have/expose:
>
> vdso_join_timens_fork()
> {
> if (mmap_write_lock_killable(mm))
> return -EINTR;
> __vdso_join_timens_unlocked()
> mmap_write_unlock(mm);
> }
>
> and
>
> vdso_join_timens_install()
> {
> mmap_write_lock(mm);
> __vdso_join_timens_unlocked()
> mmap_write_unlock(mm);
> }
I think it's not needed. On fork() it's called on creation of new timens:
: if (nsproxy->time_ns == nsproxy->time_ns_for_children)
: return 0;
So the vdso_join_timens() is called on setns() or on creation of new
namespace, which both are quite heavy operations themselves (in sense of
locking).
Thanks,
Dmitry
