linux-kernel - [PATCH] mm/percpu: prevent concurrency problem for pcpu_nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250702082749.141616-1-aha310510@gmail.com>
Date: Wed,  2 Jul 2025 17:27:49 +0900
From: Jeongjun Park <aha310510@...il.com>
To: dennis@...nel.org,
	tj@...nel.org,
	cl@...two.org
Cc: akpm@...ux-foundation.org,
	vbabka@...e.cz,
	rientjes@...gle.com,
	linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	syzbot+e5bd32b79413e86f389e@...kaller.appspotmail.com,
	Jeongjun Park <aha310510@...il.com>
Subject: [PATCH] mm/percpu: prevent concurrency problem for pcpu_nr_populated read with spin lock

Read/Write to pcpu_nr_populated should be performed while protected
by pcpu_lock. However, pcpu_nr_pages() reads pcpu_nr_populated without any
protection, which causes a data race between read/write.

Therefore, when reading pcpu_nr_populated in pcpu_nr_pages(), it should be
modified to be protected by pcpu_lock.

Reported-by: syzbot+e5bd32b79413e86f389e@...kaller.appspotmail.com
Fixes: 7e8a6304d541 ("/proc/meminfo: add percpu populated pages count")
Signed-off-by: Jeongjun Park <aha310510@...il.com>
---
 mm/percpu.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/mm/percpu.c b/mm/percpu.c
index b35494c8ede2..0f98b857fb36 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -3355,7 +3355,13 @@ void __init setup_per_cpu_areas(void)
  */
 unsigned long pcpu_nr_pages(void)
 {
-	return pcpu_nr_populated * pcpu_nr_units;
+	unsigned long flags, ret;
+
+	spin_lock_irqsave(&pcpu_lock, flags);
+	ret = pcpu_nr_populated * pcpu_nr_units;
+	spin_unlock_irqrestore(&pcpu_lock, flags);
+
+	return ret;
 }
 
 /*
--