linux-kernel - [PATCH v1] pid: annotate data-races around pid_ns->pid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250423115542.7081-1-jiayuan.chen@linux.dev>
Date: Wed, 23 Apr 2025 19:55:32 +0800
From: Jiayuan Chen <jiayuan.chen@...ux.dev>
To: linux-kernel@...r.kernel.org
Cc: mrpre@....com,
	mkoutny@...e.com,
	Jiayuan Chen <jiayuan.chen@...ux.dev>,
	syzbot+adcaa842b762a1762e7d@...kaller.appspotmail.com,
	syzbot+fab52e3459fa2f95df57@...kaller.appspotmail.com,
	syzbot+0718f65353d72efaac1e@...kaller.appspotmail.com,
	Andrew Morton <akpm@...ux-foundation.org>,
	Christian Brauner <brauner@...nel.org>,
	Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
	"Liam R. Howlett" <Liam.Howlett@...cle.com>,
	Suren Baghdasaryan <surenb@...gle.com>,
	Wei Yang <richard.weiyang@...il.com>,
	David Hildenbrand <david@...hat.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	Oleg Nesterov <oleg@...hat.com>,
	Mateusz Guzik <mjguzik@...il.com>,
	Joel Granados <joel.granados@...nel.org>,
	Jens Axboe <axboe@...nel.dk>,
	Wei Liu <wei.liu@...nel.org>,
	Frederic Weisbecker <frederic@...nel.org>
Subject: [PATCH v1] pid: annotate data-races around pid_ns->pid_allocated

Suppress syzbot reports by annotating these accesses using
READ_ONCE() / WRITE_ONCE().

Reported-by: syzbot+adcaa842b762a1762e7d@...kaller.appspotmail.com
Reported-by: syzbot+fab52e3459fa2f95df57@...kaller.appspotmail.com
Reported-by: syzbot+0718f65353d72efaac1e@...kaller.appspotmail.com
Signed-off-by: Jiayuan Chen <jiayuan.chen@...ux.dev>
---
 kernel/fork.c          | 2 +-
 kernel/pid.c           | 7 ++++---
 kernel/pid_namespace.c | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index c4b26cd8998b..1966ddea150d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2584,7 +2584,7 @@ __latent_entropy struct task_struct *copy_process(
 	rseq_fork(p, clone_flags);
 
 	/* Don't start children in a dying pid namespace */
-	if (unlikely(!(ns_of_pid(pid)->pid_allocated & PIDNS_ADDING))) {
+	if (unlikely(!(READ_ONCE(ns_of_pid(pid)->pid_allocated) & PIDNS_ADDING))) {
 		retval = -ENOMEM;
 		goto bad_fork_core_free;
 	}
diff --git a/kernel/pid.c b/kernel/pid.c
index 4ac2ce46817f..47e74457572f 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -122,7 +122,8 @@ void free_pid(struct pid *pid)
 	for (i = 0; i <= pid->level; i++) {
 		struct upid *upid = pid->numbers + i;
 		struct pid_namespace *ns = upid->ns;
-		switch (--ns->pid_allocated) {
+		WRITE_ONCE(ns->pid_allocated, READ_ONCE(ns->pid_allocated) - 1);
+		switch (READ_ONCE(ns->pid_allocated)) {
 		case 2:
 		case 1:
 			/* When all that is left in the pid namespace
@@ -271,13 +272,13 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid,
 	upid = pid->numbers + ns->level;
 	idr_preload(GFP_KERNEL);
 	spin_lock(&pidmap_lock);
-	if (!(ns->pid_allocated & PIDNS_ADDING))
+	if (!(READ_ONCE(ns->pid_allocated) & PIDNS_ADDING))
 		goto out_unlock;
 	pidfs_add_pid(pid);
 	for ( ; upid >= pid->numbers; --upid) {
 		/* Make the PID visible to find_pid_ns. */
 		idr_replace(&upid->ns->idr, pid, upid->nr);
-		upid->ns->pid_allocated++;
+		WRITE_ONCE(upid->ns->pid_allocated, READ_ONCE(upid->ns->pid_allocated) + 1);
 	}
 	spin_unlock(&pidmap_lock);
 	idr_preload_end();
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 7098ed44e717..148f7789d6f3 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -268,7 +268,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
 	 */
 	for (;;) {
 		set_current_state(TASK_INTERRUPTIBLE);
-		if (pid_ns->pid_allocated == init_pids)
+		if (READ_ONCE(pid_ns->pid_allocated) == init_pids)
 			break;
 		schedule();
 	}
-- 
2.47.1