linux-kernel - Re: [PATCH] taskstats: fix data-race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 06 Nov 2019 11:27:03 +1100
From:   Balbir Singh <bsingharora@...il.com>
To:     Christian Brauner <christian.brauner@...ntu.com>,
        syzbot+c5d03165a1bd1dead0c1@...kaller.appspotmail.com
Cc:     elver@...gle.com, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH] taskstats: fix data-race

On Sat, 2019-10-05 at 13:28 +0200, Christian Brauner wrote:
> When assiging and testing taskstats in taskstats
> taskstats_exit() there's a race around writing and reading sig->stats.
> 
> cpu0:
> task calls exit()
> do_exit()
> 	-> taskstats_exit()
> 		-> taskstats_tgid_alloc()
> The task takes sighand lock and assigns new stats to sig->stats.
> 
> cpu1:
> task catches signal
> do_exit()
> 	-> taskstats_tgid_alloc()
> 		-> taskstats_exit()
> The tasks reads sig->stats __without__ holding sighand lock seeing
> garbage.
> 
> Fix this by taking sighand lock when reading sig->stats.
> 

Hi

Sorry I am just catching up with my inbox, why is sig->stats garbage? I'll
need to go back and look, unsigned long (pointer) reads are atomic and the
expectation is that they would be NULL initially and then non NULL for thread
groups when first allocated. May be I am just being dense in the morning -
what am I missing?

Balbir Singh.