Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Yanfei Xu <yanfei.xu@windriver.com>
To:     paulmck@kernel.org, josh@joshtriplett.org, rostedt@goodmis.org,
        mathieu.desnoyers@efficios.com, jiangshanlai@gmail.com,
        joel@joelfernandes.org,
        syzbot+7b2b13f4943374609532@syzkaller.appspotmail.com
Cc:     rcu@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2] rcu-tasks: Fix an use-after-free when grace-period kthread touch the task_strcut
Date:   Wed, 26 May 2021 11:20:55 +0800
Message-Id: <20210526032055.2927345-1-yanfei.xu@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from pek-lpggp1.wrs.com (60.247.85.82) by HK2PR0401CA0017.apcprd04.prod.outlook.com (2603:1096:202:2::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4173.20 via Frontend Transport; Wed, 26 May 2021 03:21:10 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 4794280b-6082-40be-7efd-08d91ff550fd
X-MS-TrafficTypeDiagnostic: BY5PR11MB4306:
X-Microsoft-Antispam-PRVS: <BY5PR11MB43060E3B5A4F17F0DD23763BE4249@BY5PR11MB4306.namprd11.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:1728;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: w2q0y9Gt9JTx9htxhwt/MpwBBlkuXOVMvmXTA3mC6IGukOYf7My50eWoegBb5l+646gywb7Sft7s4E9TVzUshlETLw7cgbj/UJSQKT1Z8Xc1aWOz124zBtRmsd9YDURUr2Y9fQAHPjwMLZLa4QdVntYMRGDkIIC+bvIgATBX3mBAx1j8OKg22BBWzmTH95ie4kHE8Fm0NJIv0dpNSLqW8pinqr6K5Pl4V4oCl+wQ/hE0+L2gioCBDyyuPPNDvG1A869j4Dehyd797U98l1T1bOx1LXMdcd8m61/kbhNIA1qoUCJxUo1mkpRu78snlRavRpqAh+i3WdqnVaMjao+9nbisp2/Q1GUN2piUEc7IzVP26kD4yjaorK+AAHXmITGIB9ac5+fDfXU7JCCIsHc7hMoyM9rqZ8PS2SqIJ2mHbVxkdX6+Qprnady6KTT2LjWdVfZMNDD9eYD/ggRjrRwV6MUJhyFm20IPPI65tN7DE8uU2b4rKWFZueztYuiQqh5M9qP+RTGdL1xX5buObS1rLJVV5baVYXkea4Gh1TdcmWWKWMlJl6CVwhGKdAy3yAD8tuKlGQZTWOxxTyDCxOhumR2/Gf7uX8B1l5+B0W2mdHCZp4WaSqOO3XTq08C39/McsFaNAZrdZ+6SjmeeBnzq4Q==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY5PR11MB4241.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(396003)(136003)(366004)(346002)(39850400004)(376002)(38100700002)(2616005)(83380400001)(6506007)(1076003)(66556008)(956004)(36756003)(8936002)(8676002)(38350700002)(66476007)(26005)(6666004)(2906002)(478600001)(6512007)(86362001)(4326008)(66946007)(5660300002)(52116002)(44832011)(316002)(16526019)(6486002)(186003);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?nxrUP3142ZikmpE7pFgAFrtagS3H6st9Zlmsc4KPh2HjrepqIxNPw2UjjPTM?=
 =?us-ascii?Q?2e6SxdLlEiSsIlW1HwMq1MhQaWakX9n6WmOOpRR+NcB0uZfMFyfY89IeR9UL?=
 =?us-ascii?Q?dlX+WABQ0Pw98dIMXzdlIU/X8pt3bw6IdoeQeziN2mTGYnRKik4WNYDVhwsf?=
 =?us-ascii?Q?CTlyEG35Tbndp30xRAS3WfXZERm0SG8bvghCQcC8lhTI/m2ratqFxezqlv0n?=
 =?us-ascii?Q?Wcwxk31WDD0GiVdjd9psAbeSx2CVB9M9/ZAV+C7gliuHVGNg28ZKiWkHE1Y0?=
 =?us-ascii?Q?lBkbmG1s42y6ZrrGjigqqTlizJBQtPn9zabN7rrCXGBn/U0KhxKcXkgixs5J?=
 =?us-ascii?Q?LQxghnwLX5JYCWQPrPUog9SAE0DRtSTf+C1vQIgOlU5sA1i7nZ/YMV4NijYi?=
 =?us-ascii?Q?PkT+u5tIvlkFTwD0FmMwRYXoY5qbtUHMnb/qAJJq6FIspWraVoEVhEJ4Myah?=
 =?us-ascii?Q?s0j7eV/Gi97tHXB06NNRX6XckCiNYjPgO/sGalLAM4jNto+SFQaJQhINWBMx?=
 =?us-ascii?Q?jxYfas2Y7bOfE16BYukn6G6D8Ll+qjQjaAYO/2tZSnyUpnIOiyP3ClC2F1Tg?=
 =?us-ascii?Q?B2hywsF2QkrILs9n3P5ALycjSoV6oWUF7r+TkJma+vhl1AaVWktkl19r5wo8?=
 =?us-ascii?Q?oZ8YnvnRepTqZp5sLAvrSdCeoBCzFwEaN4NgJaW5ILpbVI2b+w5audMtD2eg?=
 =?us-ascii?Q?dzKECfMDccPEtFdGaYyKKzJemNRnN11q3+k79P9sUx2voFs7hVEHoQmVk6fk?=
 =?us-ascii?Q?xE+yvsG2OhK7jYAJvPhMZdz3mQ/l1lGhUPElgxJVI9cvsJDpmYczp0F9BJVu?=
 =?us-ascii?Q?hZiDR0STZQ4ex9dOPV3/WU1MvAmoLXFK8gRvTdxSuU7GwIFKD5u4di7P2vsn?=
 =?us-ascii?Q?VzrWHx1/7l3xoYOI6HW/Qv8zgkkQ5kaNL/NPmFe87VEdliLfoPVVBB246Tf6?=
 =?us-ascii?Q?jyFWvjJBzJrM9WGeqrsm7bLg/VZmI/2ir4eckJZhvaNi5xp3huEZYLVK3qGq?=
 =?us-ascii?Q?tT6Q3v7SYYS8r0W8DOaXWOQHuqnoTaddQv6hc20163CW7itke3/fIbqq6leK?=
 =?us-ascii?Q?0R8vXNfvrmSatz129GE2NxEt/+HFxL+LYw8JOPVsjEXlqsYIzq/DJwoJ7SoV?=
 =?us-ascii?Q?vMItGLGsKv1PcvdTY6gpXuCVvWH+v0Pa4iRg9osk/I7MIjOh+/8qD13L89cj?=
 =?us-ascii?Q?eqLcxYU/k4WwzlHYZaEwHV5P5uLtgskw9PouBhwp+wULHxRXbxGP8Xxr575o?=
 =?us-ascii?Q?RpXljnc79Nfs0qQZZUBt6ySAJ5i1OmwjY+H9sgUbqpQvUmaYm72Rg4AV3iLh?=
 =?us-ascii?Q?NMS8FDu7Jnm2nYL59TWyhq+v?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4794280b-6082-40be-7efd-08d91ff550fd
X-MS-Exchange-CrossTenant-AuthSource: BY5PR11MB4241.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 May 2021 03:21:14.0582
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: TGRq14Bz5/WN3fZC3JrehLfWMlmo9sZ26nMIO5CWp5vJU0gc0LUIZzUs+kSV27XYs9bpO53iWNg3ClHSTKo9YA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4306
X-Proofpoint-GUID: ZiV6zyggPEL578kf2BtZGcA2oT_griE1
X-Proofpoint-ORIG-GUID: ZiV6zyggPEL578kf2BtZGcA2oT_griE1
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.761
 definitions=2021-05-26_02:2021-05-25,2021-05-26 signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501
 impostorscore=0 bulkscore=0 malwarescore=0 suspectscore=0 adultscore=0
 clxscore=1015 mlxlogscore=999 spamscore=0 mlxscore=0 phishscore=0
 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2104190000 definitions=main-2105260021
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

trc_del_holdout() invokes put_task_struct() may cause the task_struct
is freed once the task is exiting. If happened, then we shouldn't touch
the task_strcut, or it will triger an use-after-free. Here we only mark
it as checked, and grace-period kthread will romove it from holdout
list.

        CPU0                                        CPU1
trc_add_holdout(t, bhp)
//t->usage==2
......
                                       ......
                                       release_task
                                         ->put_task_struct_rcu_user
                                           ->delayed_put_task_struct
                                             ......
                                             ->put_task_struct(t)
                                             //t->usage==1

check_all_holdout_tasks_trace
  ->trc_wait_for_one_reader
    ->get_task_struct
    ->try_invoke_on_locked_down_task(trc_inspect_reader)
      ->trc_del_holdout
    ->put_task_struct(t)
  //t->usage==0 and task_struct freed
  ->READ_ONCE(t->trc_reader_checked)
  //ops, t had been freed.

BTW, do the same thing in trc_wait_for_one_reader() when the task is a
current running task even if it is safe.

Reported-by: syzbot+7b2b13f4943374609532@syzkaller.appspotmail.com
Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com>
---
v1->v2:
1. improve the commit messages.
2. change the comments in codes.

 kernel/rcu/tasks.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index 36607551f966..2303cb131367 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -872,10 +872,9 @@ static bool trc_inspect_reader(struct task_struct *t, void *arg)
 		in_qs = likely(!t->trc_reader_nesting);
 	}
 
-	// Mark as checked.  Because this is called from the grace-period
-	// kthread, also remove the task from the holdout list.
+	// Mark as checked so that the grace-period kthread will
+	// remove it from the holdout list.
 	t->trc_reader_checked = true;
-	trc_del_holdout(t);
 
 	if (in_qs)
 		return true;  // Already in quiescent state, done!!!
@@ -899,10 +898,11 @@ static void trc_wait_for_one_reader(struct task_struct *t,
 	if (smp_load_acquire(&t->trc_ipi_to_cpu) != -1) // Order IPI
 		return;
 
-	// The current task had better be in a quiescent state.
+	// The current task had better be in a quiescent state, and
+	// mark as checked so that the grace-period kthread will
+	// remove it from the holdout list.
 	if (t == current) {
 		t->trc_reader_checked = true;
-		trc_del_holdout(t);
 		WARN_ON_ONCE(t->trc_reader_nesting);
 		return;
 	}
-- 
2.27.0