lkml.org 
[lkml]   [2019]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: KCSAN: data-race in exit_signals / prepare_signal
    [+Cc Will]

    On Mon, Oct 21, 2019 at 03:34:07AM -0700, syzbot wrote:
    > Hello,
    >
    > syzbot found the following crash on:
    >
    > HEAD commit: d724f94f x86, kcsan: Enable KCSAN for x86
    > git tree: https://github.com/google/ktsan.git kcsan
    > console output: https://syzkaller.appspot.com/x/log.txt?x=13eab79f600000
    > kernel config: https://syzkaller.appspot.com/x/.config?x=c0906aa620713d80
    > dashboard link: https://syzkaller.appspot.com/bug?extid=492a4acccd8fc75ddfd0
    > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
    >
    > Unfortunately, I don't have any reproducer for this crash yet.
    >
    > IMPORTANT: if you fix the bug, please add the following tag to the commit:
    > Reported-by: syzbot+492a4acccd8fc75ddfd0@syzkaller.appspotmail.com
    >
    > ==================================================================
    > BUG: KCSAN: data-race in exit_signals / prepare_signal

    This traces back to Oleg fixing a race between a group stop and a thread
    exiting before it notices that it has a pending signal or is in the middle of
    do_exit() already, causing group stop to get wacky.
    The original commit to fix this race is
    commit d12619b5ff56 ("fix group stop with exit race") which took sighand
    lock before setting PF_EXITING on the thread.

    Later on in
    commit 5dee1707dfbf ("move the related code from exit_notify() to exit_signals()")
    an improvement was made for the single-threaded case and the
    case where the group stop is already in progress. This removed the
    sighand lock around the PF_EXITING assignment.

    If the race really matters and given how tsk->flags is currently accessed
    everywhere the simple fix for now might be:

    diff --git a/kernel/signal.c b/kernel/signal.c
    index c4da1ef56fdf..cf61e044c4cc 100644
    --- a/kernel/signal.c
    +++ b/kernel/signal.c
    @@ -2819,7 +2819,9 @@ void exit_signals(struct task_struct *tsk)
    cgroup_threadgroup_change_begin(tsk);

    if (thread_group_empty(tsk) || signal_group_exit(tsk->signal)) {
    + spin_lock_irq(&tsk->sighand->siglock);
    tsk->flags |= PF_EXITING;
    + spin_unlock_irq(&tsk->sighand->siglock);
    cgroup_threadgroup_change_end(tsk);
    return;
    }
    Christian

    \
     
     \ /
      Last update: 2019-10-21 13:20    [W:3.317 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site