linux-kernel - Re: [patch V2 3/4] sched/mmcid: Drop per CPU CID immediately when switching to per task mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYtE2xHG2A8DWWmD@shinmob>
Date: Tue, 10 Feb 2026 14:55:16 +0000
From: Shinichiro Kawasaki <shinichiro.kawasaki@....com>
To: Thomas Gleixner <tglx@...nel.org>
CC: LKML <linux-kernel@...r.kernel.org>, Ihor Solodrai
	<ihor.solodrai@...ux.dev>, Shrikanth Hegde <sshegde@...ux.ibm.com>, Peter
 Zijlstra <peterz@...radead.org>, Mathieu Desnoyers
	<mathieu.desnoyers@...icios.com>, Michael Jeanson <mjeanson@...icios.com>,
	Andrey Ryabinin <ryabinin.a.a@...il.com>, Alexander Potapenko
	<glider@...gle.com>, "kasan-dev@...glegroups.com"
	<kasan-dev@...glegroups.com>
Subject: Re: [patch V2 3/4] sched/mmcid: Drop per CPU CID immediately when
 switching to per task mode

On Feb 10, 2026 / 14:33, Thomas Gleixner wrote:
[...]
> Can you please try the fix below?
> 
> Thanks
> 
>         tglx
> ---
> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> index 854984967fe2..61c2d65156b5 100644
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c
> @@ -10729,10 +10729,9 @@ void sched_mm_cid_exit(struct task_struct *t)
>  					return;
>  				/*
>  				 * Mode change. The task has the CID unset
> -				 * already. The CPU CID is still valid and
> -				 * does not have MM_CID_TRANSIT set as the
> -				 * mode change has just taken effect under
> -				 * mm::mm_cid::lock. Drop it.
> +				 * already and dealt with an eventually set
> +				 * TRANSIT bit. If the CID is owned by the CPU
> +				 * then drop it.
>  				 */
>  				mm_drop_cid_on_cpu(mm, this_cpu_ptr(mm->mm_cid.pcpu));
>  			}
> diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
> index bd350e40859d..1b4283e9edc3 100644
> --- a/kernel/sched/sched.h
> +++ b/kernel/sched/sched.h
> @@ -3758,8 +3758,10 @@ static __always_inline void mm_unset_cid_on_task(struct task_struct *t)
>  static __always_inline void mm_drop_cid_on_cpu(struct mm_struct *mm, struct mm_cid_pcpu *pcp)
>  {
>  	/* Clear the ONCPU bit, but do not set UNSET in the per CPU storage */
> -	pcp->cid = cpu_cid_to_cid(pcp->cid);
> -	mm_drop_cid(mm, pcp->cid);
> +	if (cid_on_cpu(pcp->cid)) {
> +		pcp->cid = cpu_cid_to_cid(pcp->cid);
> +		mm_drop_cid(mm, pcp->cid);
> +	}
>  }
>  
>  static inline unsigned int __mm_get_cid(struct mm_struct *mm, unsigned int max_cids)
> 

Thomas, the fix patch worked! I applied the patch on top of v6.19 kernel, then
the KASAN is no longer observed. I confirmed it with my two test nodes. Thank
you very much for the swift fix :)

In case the patch will be posted as a formal one,

Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@....com>

P.S. I stop working here tonight. If my response will be required, I will do so
     tomorrow.