linux-kernel - [PATCH v2] mm/percpu: prevent concurrency problem for pcpu_nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250703065600.132221-1-aha310510@gmail.com>
Date: Thu,  3 Jul 2025 15:56:00 +0900
From: Jeongjun Park <aha310510@...il.com>
To: dennis@...nel.org,
	tj@...nel.org,
	cl@...two.org
Cc: akpm@...ux-foundation.org,
	roman.gushchin@...ux.dev,
	rientjes@...gle.com,
	vbabka@...e.cz,
	shakeel.butt@...ux.dev,
	linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	syzbot+e5bd32b79413e86f389e@...kaller.appspotmail.com,
	Jeongjun Park <aha310510@...il.com>
Subject: [PATCH v2] mm/percpu: prevent concurrency problem for pcpu_nr_populated read with spin lock

pcpu_nr_pages() reads pcpu_nr_populated without any protection, which
causes a data race between read/write.

However, since this is an intended race, we should add a data_race
annotation instead of add a spin lock.

Reported-by: syzbot+e5bd32b79413e86f389e@...kaller.appspotmail.com
Fixes: 7e8a6304d541 ("/proc/meminfo: add percpu populated pages count")
Suggested-by: Shakeel Butt <shakeel.butt@...ux.dev>
Signed-off-by: Jeongjun Park <aha310510@...il.com>
---
v2: Change it as suggested by Shakeel Butt
- Link to v1: https://lore.kernel.org/all/20250702082749.141616-1-aha310510@gmail.com/
---
 mm/percpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/percpu.c b/mm/percpu.c
index b35494c8ede2..782cc148b39c 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -3355,7 +3355,7 @@ void __init setup_per_cpu_areas(void)
  */
 unsigned long pcpu_nr_pages(void)
 {
-	return pcpu_nr_populated * pcpu_nr_units;
+	return data_race(READ_ONCE(pcpu_nr_populated) * pcpu_nr_units);
 }
 
 /*
--