Messages in this thread Patch in this message | | | Date | Mon, 21 Oct 2019 13:19:21 +0200 | From | Christian Brauner <> | Subject | Re: KCSAN: data-race in exit_signals / prepare_signal |
| |
[+Cc Will]
On Mon, Oct 21, 2019 at 03:34:07AM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: d724f94f x86, kcsan: Enable KCSAN for x86 > git tree: https://github.com/google/ktsan.git kcsan > console output: https://syzkaller.appspot.com/x/log.txt?x=13eab79f600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=c0906aa620713d80 > dashboard link: https://syzkaller.appspot.com/bug?extid=492a4acccd8fc75ddfd0 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > Unfortunately, I don't have any reproducer for this crash yet. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+492a4acccd8fc75ddfd0@syzkaller.appspotmail.com > > ================================================================== > BUG: KCSAN: data-race in exit_signals / prepare_signal
This traces back to Oleg fixing a race between a group stop and a thread exiting before it notices that it has a pending signal or is in the middle of do_exit() already, causing group stop to get wacky. The original commit to fix this race is commit d12619b5ff56 ("fix group stop with exit race") which took sighand lock before setting PF_EXITING on the thread.
Later on in commit 5dee1707dfbf ("move the related code from exit_notify() to exit_signals()") an improvement was made for the single-threaded case and the case where the group stop is already in progress. This removed the sighand lock around the PF_EXITING assignment.
If the race really matters and given how tsk->flags is currently accessed everywhere the simple fix for now might be:
diff --git a/kernel/signal.c b/kernel/signal.c index c4da1ef56fdf..cf61e044c4cc 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -2819,7 +2819,9 @@ void exit_signals(struct task_struct *tsk) cgroup_threadgroup_change_begin(tsk);
if (thread_group_empty(tsk) || signal_group_exit(tsk->signal)) { + spin_lock_irq(&tsk->sighand->siglock); tsk->flags |= PF_EXITING; + spin_unlock_irq(&tsk->sighand->siglock); cgroup_threadgroup_change_end(tsk); return; } Christian
| |