linux-kernel - Re: [syzbot] [kernel?] KCSAN: data-race in do_timer_create / do_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 22 Apr 2023 00:36:45 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Dmitry Vyukov <dvyukov@...gle.com>,
        syzbot <syzbot+5c54bd3eb218bb595aa9@...kaller.appspotmail.com>
Cc:     linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        Marco Elver <elver@...gle.com>
Subject: Re: [syzbot] [kernel?] KCSAN: data-race in do_timer_create /
 do_timer_create (8)

On Fri, Apr 21 2023 at 16:49, Dmitry Vyukov wrote:
> int first_free_id = sig->posix_timer_id;
>
> runs concurrently with:
>
> if (++sig->posix_timer_id < 0)
>     sig->posix_timer_id = 0;
> if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT))
>     /* Loop over all possible ids completed */
>     ret = -EAGAIN;
>
> I am not sure how important/realistic this wrap-around handling is,
> but as the result of the race first_free_id can be negative (if it
> reads the value at just the right moment). Then wrap-around will never
> be detected and the loop will loop forever uninterruptably.

It's probably not that problematic, but that code is silly for other
reasons. I'll have a look.

Thanks,

        tglx