cgroupfs mounts can hang

[Tycho Andersen]

SRU Justification

Impact: In some circumstances mount(2) of cgroup can endlessly return ERESTARTNOINTR, causing mount(8) to endlessly spin in loop.

Fix: Drop sauce patches for making cgroupfs work with s_user_ns in favor of patches from linux-next which do not have this problem.

Regression potential: The changes go beyond simply fixing the bug in order to sync up with upstream, but the upstream patches are by and large functionally equivalent. One consequence is that the bpf fs will no longer be mountable in a user namespace, but this fs is new in 4.4, unused as far as I can tell, and broken for user namespace mounts anyway.

---

Consider the following,

root@dev:/tmp# mkdir foo
root@dev:/tmp# mount -t cgroup -o none,name=foo none foo
root@dev:/tmp# mkdir -p foo/bad
root@dev:/tmp# umount -l foo
root@dev:/tmp# mount -t cgroup -o none,name=foo none foo # hangs forever
^C
root@dev:/tmp# uname -a
Linux dev 4.4.0-22-generic #40-Ubuntu SMP Thu May 12 22:03:46 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

When I strace the mount task, I get a whole bunch of,

mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/tmp/foo", "cgroup", MS_MGC_VAL, "none,name=foo") = ? ERESTARTNOINTR (To be restarted)

Which I think means that we're looping on,

https://github.com/torvalds/linux/blob/master/kernel/cgroup.c#L2137

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1588056

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Tycho Andersen (tycho-s)]

Note that this doesn't happen on linux-next, whose HEAD is,

commit e98f2ba41687651055312e0ae617604dd6f7f200
Author: Stephen Rothwell <email address hidden>
Date: Wed Jun 1 13:08:58 2016 +1000

    Add linux-next specific files for 20160601

    Signed-off-by: Stephen Rothwell <email address hidden>

right now.

[Seth Forshee (sforshee)]

Please test the build at the link below and see if it resolves your issues. Thanks!

http://people.canonical.com/~sforshee/lp1588056/

[Tycho Andersen (tycho-s)]

Yep, this works for me (both checkpoint and restore of containers under this build, and also the original use case that caused me to find the bug). Thanks, Seth!

[Seth Forshee (sforshee)]

@Tycho: One more build for you to test if you could. The patches I pulled in changed some before they hit linux-next, so this version uses those patches.

http://people.canonical.com/~sforshee/lp1588056/linux-4.4.0-24.42~lp1588056v201606020847/

[Tycho Andersen (tycho-s)]

+1, these kernels work for me in my original application too, thanks Seth.

[Kamal Mostafa (kamalmostafa)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.4.0-30.49

---------------
linux (4.4.0-30.49) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1597897

  * FCP devices are not detected correctly nor deterministically (LP: #1567602)
    - scsi_dh_alua: Disable ALUA handling for non-disk devices
    - scsi_dh_alua: Use vpd_pg83 information
    - scsi_dh_alua: improved logging
    - scsi_dh_alua: sanitze sense code handling
    - scsi_dh_alua: use standard logging functions
    - scsi_dh_alua: return standard SCSI return codes in submit_rtpg
    - scsi_dh_alua: fixup description of stpg_endio()
    - scsi_dh_alua: use flag for RTPG extended header
    - scsi_dh_alua: use unaligned access macros
    - scsi_dh_alua: rework alua_check_tpgs() to return the tpgs mode
    - scsi_dh_alua: simplify sense code handling
    - scsi: Add scsi_vpd_lun_id()
    - scsi: Add scsi_vpd_tpg_id()
    - scsi_dh_alua: use scsi_vpd_tpg_id()
    - scsi_dh_alua: Remove stale variables
    - scsi_dh_alua: Pass buffer as function argument
    - scsi_dh_alua: separate out alua_stpg()
    - scsi_dh_alua: Make stpg synchronous
    - scsi_dh_alua: call alua_rtpg() if stpg fails
    - scsi_dh_alua: switch to scsi_execute_req_flags()
    - scsi_dh_alua: allocate RTPG buffer separately
    - scsi_dh_alua: Use separate alua_port_group structure
    - scsi_dh_alua: use unique device id
    - scsi_dh_alua: simplify alua_initialize()
    - revert commit a8e5a2d593cb ("[SCSI] scsi_dh_alua: ALUA handler attach should
      succeed while TPG is transitioning")
    - scsi_dh_alua: move optimize_stpg evaluation
    - scsi_dh_alua: remove 'rel_port' from alua_dh_data structure
    - scsi_dh_alua: Use workqueue for RTPG
    - scsi_dh_alua: Allow workqueue to run synchronously
    - scsi_dh_alua: Add new blacklist flag 'BLIST_SYNC_ALUA'
    - scsi_dh_alua: Recheck state on unit attention
    - scsi_dh_alua: update all port states
    - scsi_dh_alua: Send TEST UNIT READY to poll for transitioning
    - scsi_dh_alua: do not fail for unknown VPD identification

linux (4.4.0-29.48) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1597015

  * Wireless hotkey fails on Dell XPS 15 9550 (LP: #1589886)
    - intel-hid: new hid event driver for hotkeys
    - intel-hid: fix incorrect entries in intel_hid_keymap
    - intel-hid: allocate correct amount of memory for private struct
    - intel-hid: add a workaround to ignore an event after waking up from S4.
    - [Config] CONFIG_INTEL_HID_EVENT=m

  * cgroupfs mounts can hang (LP: #1588056)
    - Revert "UBUNTU: SAUCE: (namespace) mqueue: Super blocks must be owned by the
      user ns which owns the ipc ns"
    - Revert "UBUNTU: SAUCE: kernfs: Do not match superblock in another user
      namespace when mounting"
    - Revert "UBUNTU: SAUCE: cgroup: Use a new super block when mounting in a
      cgroup namespace"
    - (namespace) bpf: Use mount_nodev not mount_ns to mount the bpf filesystem
    - (namespace) bpf, inode: disallow userns mounts
    - (namespace) ipc: Initialize ipc_namespace->user_ns early.
    - (namespace) vfs: Pass data, ns, and ns->userns to mount_ns
    - SAUCE: (namespace) S...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.4.0-31.50

---------------
linux (4.4.0-31.50) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1602449

  * nouveau: boot hangs at blank screen with unsupported graphics cards
    (LP: #1602340)
    - SAUCE: drm: check for supported chipset before booting fbdev off the hw

linux (4.4.0-30.49) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1597897

  * FCP devices are not detected correctly nor deterministically (LP: #1567602)
    - scsi_dh_alua: Disable ALUA handling for non-disk devices
    - scsi_dh_alua: Use vpd_pg83 information
    - scsi_dh_alua: improved logging
    - scsi_dh_alua: sanitze sense code handling
    - scsi_dh_alua: use standard logging functions
    - scsi_dh_alua: return standard SCSI return codes in submit_rtpg
    - scsi_dh_alua: fixup description of stpg_endio()
    - scsi_dh_alua: use flag for RTPG extended header
    - scsi_dh_alua: use unaligned access macros
    - scsi_dh_alua: rework alua_check_tpgs() to return the tpgs mode
    - scsi_dh_alua: simplify sense code handling
    - scsi: Add scsi_vpd_lun_id()
    - scsi: Add scsi_vpd_tpg_id()
    - scsi_dh_alua: use scsi_vpd_tpg_id()
    - scsi_dh_alua: Remove stale variables
    - scsi_dh_alua: Pass buffer as function argument
    - scsi_dh_alua: separate out alua_stpg()
    - scsi_dh_alua: Make stpg synchronous
    - scsi_dh_alua: call alua_rtpg() if stpg fails
    - scsi_dh_alua: switch to scsi_execute_req_flags()
    - scsi_dh_alua: allocate RTPG buffer separately
    - scsi_dh_alua: Use separate alua_port_group structure
    - scsi_dh_alua: use unique device id
    - scsi_dh_alua: simplify alua_initialize()
    - revert commit a8e5a2d593cb ("[SCSI] scsi_dh_alua: ALUA handler attach should
      succeed while TPG is transitioning")
    - scsi_dh_alua: move optimize_stpg evaluation
    - scsi_dh_alua: remove 'rel_port' from alua_dh_data structure
    - scsi_dh_alua: Use workqueue for RTPG
    - scsi_dh_alua: Allow workqueue to run synchronously
    - scsi_dh_alua: Add new blacklist flag 'BLIST_SYNC_ALUA'
    - scsi_dh_alua: Recheck state on unit attention
    - scsi_dh_alua: update all port states
    - scsi_dh_alua: Send TEST UNIT READY to poll for transitioning
    - scsi_dh_alua: do not fail for unknown VPD identification

linux (4.4.0-29.48) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1597015

  * Wireless hotkey fails on Dell XPS 15 9550 (LP: #1589886)
    - intel-hid: new hid event driver for hotkeys
    - intel-hid: fix incorrect entries in intel_hid_keymap
    - intel-hid: allocate correct amount of memory for private struct
    - intel-hid: add a workaround to ignore an event after waking up from S4.
    - [Config] CONFIG_INTEL_HID_EVENT=m

  * cgroupfs mounts can hang (LP: #1588056)
    - Revert "UBUNTU: SAUCE: (namespace) mqueue: Super blocks must be owned by the
      user ns which owns the ipc ns"
    - Revert "UBUNTU: SAUCE: kernfs: Do not match superblock in another user
      namespace when mounting"
    - Revert "UBUNTU: SAUCE: cgroup: Use a new super block when mounting in a
      cgroup namespace"
    - (name...