Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <50abba6cb6643a8beaf29b233bea28d7b6eed5e5.camel@gmail.com>
Subject: Re: [PATCH] taskstats: fix data-race
From:   Balbir Singh <bsingharora@gmail.com>
To:     Christian Brauner <christian.brauner@ubuntu.com>,
        syzbot+c5d03165a1bd1dead0c1@syzkaller.appspotmail.com
Cc:     elver@google.com, linux-kernel@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Date:   Wed, 06 Nov 2019 11:27:03 +1100
In-Reply-To: <20191005112806.13960-1-christian.brauner@ubuntu.com>
References: <0000000000009b403005942237bf@google.com>
         <20191005112806.13960-1-christian.brauner@ubuntu.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Sat, 2019-10-05 at 13:28 +0200, Christian Brauner wrote:
> When assiging and testing taskstats in taskstats
> taskstats_exit() there's a race around writing and reading sig->stats.
> 
> cpu0:
> task calls exit()
> do_exit()
> 	-> taskstats_exit()
> 		-> taskstats_tgid_alloc()
> The task takes sighand lock and assigns new stats to sig->stats.
> 
> cpu1:
> task catches signal
> do_exit()
> 	-> taskstats_tgid_alloc()
> 		-> taskstats_exit()
> The tasks reads sig->stats __without__ holding sighand lock seeing
> garbage.
> 
> Fix this by taking sighand lock when reading sig->stats.
> 

Hi

Sorry I am just catching up with my inbox, why is sig->stats garbage? I'll
need to go back and look, unsigned long (pointer) reads are atomic and the
expectation is that they would be NULL initially and then non NULL for thread
groups when first allocated. May be I am just being dense in the morning -
what am I missing?

Balbir Singh.