linux-kernel - KCSAN: data-race in exit_mm / mm_update_next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 10 Jan 2022 21:13:19 +0800
From:   cruise k <cruise4k@...il.com>
To:     Christian Brauner <christian@...uner.io>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Kees Cook <keescook@...omium.org>,
        "Peter Zijlstra (Intel)" <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Oleg Nesterov <oleg@...hat.com>,
        Hao Xu <haoxu@...ux.alibaba.com>,
        Alexey Gladkov <legion@...nel.org>,
        Jim Newsome <jnewsome@...project.org>,
        linux-kernel@...r.kernel.org
Cc:     sunhao.th@...il.com, xyru1999@...il.com
Subject: KCSAN: data-race in exit_mm / mm_update_next_owner

Hi,

When using Syzkaller to fuzz the Linux kernel, it triggers the following crash.

HEAD commit: a7904a538933 Linux 5.16-rc6
git tree: upstream
console output: https://pastebin.com/YG3070s7
kernel config: https://pastebin.com/jtW18g1Y

If you fix this issue, please add the following tag to the commit:
Reported-by: Yuheng Shen mosesfonscqf75@...il.com


==================================================================
BUG: KCSAN: data-race in exit_mm / mm_update_next_owner

write to 0xffff888127dc44c8 of 8 bytes by task 27494 on cpu 5:
 exit_mm+0x98/0x170 kernel/exit.c:500
 do_exit+0x5e9/0x17f0 kernel/exit.c:819
 do_group_exit+0xc5/0x180 kernel/exit.c:929
 get_signal+0xde4/0x14e0 kernel/signal.c:2852
 arch_do_signal_or_restart+0x8c/0x2d0 arch/x86/kernel/signal.c:868
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
 exit_to_user_mode_prepare+0x106/0x190 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:300
 do_syscall_64+0x50/0xd0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888127dc44c8 of 8 bytes by task 27493 on cpu 2:
 mm_update_next_owner+0x23c/0x4e0 kernel/exit.c:432
 exit_mm+0xd3/0x170 kernel/exit.c:506
 do_exit+0x5e9/0x17f0 kernel/exit.c:819
 do_group_exit+0x16c/0x180 kernel/exit.c:929
 __do_sys_exit_group+0xb/0x10 kernel/exit.c:940
 __se_sys_exit_group+0x5/0x10 kernel/exit.c:938
 __x64_sys_exit_group+0x16/0x20 kernel/exit.c:938
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff88812ae87800 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 2 PID: 27493 Comm: syz-executor.4 Not tainted 5.16.0-rc8+ #11

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
==================================================================