commit | 96e48ae389b5113e5ba930c3564eda66dd083fdc | [log] [tgz] |
---|---|---|
author | Christian Brauner <christian.brauner@ubuntu.com> | Wed Oct 09 13:48:09 2019 +0200 |
committer | Christian Brauner <christian.brauner@ubuntu.com> | Wed Oct 09 15:22:09 2019 +0200 |
tree | 2cd594b66219022c908b0b1e6c49cb7e828d95cd | |
parent | da0c9ea146cbe92b832f1b0f694840ea8eb33cce [diff] |
taskstats: fix data-race When assiging and testing taskstats in taskstats_exit() there's a race when writing and reading sig->stats when a thread-group with more than one thread exits: cpu0: thread catches fatal signal and whole thread-group gets taken down do_exit() do_group_exit() taskstats_exit() taskstats_tgid_alloc() The tasks reads sig->stats without holding sighand lock seeing garbage. cpu1: task calls exit_group() do_exit() do_group_exit() taskstats_exit() taskstats_tgid_alloc() The task takes sighand lock and assigns new stats to sig->stats. Fix this by using smp_load_acquire() and smp_store_release(). Reported-by: syzbot+c5d03165a1bd1dead0c1@syzkaller.appspotmail.com Fixes: 34ec12349c8a ("taskstats: cleanup ->signal->stats allocation") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> Link: https://lore.kernel.org/r/20191009114809.8643-1-christian.brauner@ubuntu.com --- /* v1 */ Link: https://lore.kernel.org/r/20191005112806.13960-1-christian.brauner@ubuntu.com /* v2 */ Link: https://lore.kernel.org/r/20191006235216.7483-1-christian.brauner@ubuntu.com - Dmitry Vyukov <dvyukov@google.com>, Marco Elver <elver@google.com>: - fix the original double-checked locking using memory barriers /* v3 */ Link: https://lore.kernel.org/r/20191007110117.1096-1-christian.brauner@ubuntu.com - Andrea Parri <parri.andrea@gmail.com>: - document memory barriers to make checkpatch happy /* v4 */ Link: https://lore.kernel.org/r/20191009113134.5171-1-christian.brauner@ubuntu.com - Andrea Parri <parri.andrea@gmail.com>: - use smp_load_acquire(), not READ_ONCE() - update commit message /* v5 */ - Andrea Parri <parri.andrea@gmail.com>: - fix typo in smp_load_acquire()