linux-kernel - [PATCH] seqlock, procfs: Fix scoped_seqlock_read() critical section in do_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <aS5mdHYhHi9Gi5-r@gmail.com>
Date: Tue, 2 Dec 2025 05:09:24 +0100
From: Ingo Molnar <mingo@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>
Cc: linux-kernel@...r.kernel.org, Oleg Nesterov <oleg@...hat.com>
Subject: [PATCH] seqlock, procfs: Fix scoped_seqlock_read() critical section
 in do_task_stat()


RCU read-lock should not nest inside a read-seqlock 
irqsave ->stats_lock IRQs-off critical section, but 
should go on the outside, like it's done in 
fs/proc/base.c:do_io_accounting().

Looks like this was a pre-existing bug dating back to:

  7601df8031fd ("fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats")

... but this recent commit made it more apparent:

  b76f72bea2c6 ("seqlock: Change do_task_stat() to use scoped_seqlock_read()")

To fix it, move the rcu_read_lock() on the outside, and 
convert it to a guard(rcu)() construct. Add an extra 
depth to the local scope to make sure the RCU critical 
section is kept strictly to the intended area.

Fixes: b76f72bea2c6 ("seqlock: Change do_task_stat() to use scoped_seqlock_read()")
Fixes: 7601df8031fd ("fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats")
Signed-off-by: Ingo Molnar <mingo@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>
---
 fs/proc/array.c | 41 +++++++++++++++++++++--------------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/fs/proc/array.c b/fs/proc/array.c
index cbd4bc4a58e4..6a35825c45a6 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -537,27 +537,28 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
 	if (permitted && (!whole || num_threads < 2))
 		wchan = !task_is_running(task);
 
-	scoped_seqlock_read (&sig->stats_lock, ss_lock_irqsave) {
-		cmin_flt = sig->cmin_flt;
-		cmaj_flt = sig->cmaj_flt;
-		cutime = sig->cutime;
-		cstime = sig->cstime;
-		cgtime = sig->cgtime;
-
-		if (whole) {
-			struct task_struct *t;
-
-			min_flt = sig->min_flt;
-			maj_flt = sig->maj_flt;
-			gtime = sig->gtime;
-
-			rcu_read_lock();
-			__for_each_thread(sig, t) {
-				min_flt += t->min_flt;
-				maj_flt += t->maj_flt;
-				gtime += task_gtime(t);
+	{
+		guard(rcu)();
+		scoped_seqlock_read (&sig->stats_lock, ss_lock_irqsave) {
+			cmin_flt = sig->cmin_flt;
+			cmaj_flt = sig->cmaj_flt;
+			cutime = sig->cutime;
+			cstime = sig->cstime;
+			cgtime = sig->cgtime;
+
+			if (whole) {
+				struct task_struct *t;
+
+				min_flt = sig->min_flt;
+				maj_flt = sig->maj_flt;
+				gtime = sig->gtime;
+
+				__for_each_thread(sig, t) {
+					min_flt += t->min_flt;
+					maj_flt += t->maj_flt;
+					gtime += task_gtime(t);
+				}
 			}
-			rcu_read_unlock();
 		}
 	}
 
-- 
2.51.0