From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0480DC7618E for ; Mon, 24 Apr 2023 08:25:18 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7908F6B0071; Mon, 24 Apr 2023 04:25:18 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 740E96B0074; Mon, 24 Apr 2023 04:25:18 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 608ED6B0075; Mon, 24 Apr 2023 04:25:18 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 51C2F6B0071 for ; Mon, 24 Apr 2023 04:25:18 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 16404C015F for ; Mon, 24 Apr 2023 08:25:18 +0000 (UTC) X-FDA: 80715599916.27.F9F252C Received: from mail-lf1-f51.google.com (mail-lf1-f51.google.com [209.85.167.51]) by imf22.hostedemail.com (Postfix) with ESMTP id 49FFCC0004 for ; Mon, 24 Apr 2023 08:25:14 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=CesUfe+p; spf=pass (imf22.hostedemail.com: domain of dvyukov@google.com designates 209.85.167.51 as permitted sender) smtp.mailfrom=dvyukov@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1682324715; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=j18LTPw/0ZiwBV/EQmierqo28H2NNyEAjpLUZMbxn80=; b=xHpHuylKW1h3xzu3hKgtOZsc/eQSI38oaU7SjFwXntO9EIdY4UcTngsF+A39VWwzfMQIcN nfACKvn6MCOfTpSLeUYbSBoGV5aeUz8FLfr9Mfx3vsTMEkypL3TQVuJM25B4a6aueZx1KW rMm4GSEej9HplJUbam3hLTyMMXVxgg4= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=CesUfe+p; spf=pass (imf22.hostedemail.com: domain of dvyukov@google.com designates 209.85.167.51 as permitted sender) smtp.mailfrom=dvyukov@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1682324715; a=rsa-sha256; cv=none; b=c/bsKI9Bs2G+r+bOlTb4C2Y1D2iboaK2HvIUZK+DbX49ijy2pRwpBhK1fPKFU4iW8dUsOd YPIiTkeZ0e83pRGCwjA/+mOx34dz3I87RH8Tb4Nr0pHleyULq26/LnjUH3Zmd9VZBIozLK JGr1HO/Wik7cZJZdWpmCVlReRSdAoNY= Received: by mail-lf1-f51.google.com with SMTP id 2adb3069b0e04-4efea87c578so2276e87.1 for ; Mon, 24 Apr 2023 01:25:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1682324713; x=1684916713; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=j18LTPw/0ZiwBV/EQmierqo28H2NNyEAjpLUZMbxn80=; b=CesUfe+p8d0dkEmrufChgURYmQzPVsRKB6Z1zq/0m7jQFerLN1vm3sKO5u2K/rl8sJ 753Xb1kwNpqsBLPPmYoA5D+gusVtmDUbYgFOfDLoue7QdZQWNHon9ozJTA5RjVwFMkRL AnIoCuhdETOi2d3M+DoGmCRI0qslU+tTb1mfNS7drK8UaW9VeLrCnkq4Fqi2j5alos/A IZikzBkRNKNvM0btTwz4vgI7z6JQ0rR5oqbZStxatygVFvg2zG7l8lGwK2GYsyt17272 RWCij0rqF2sPbmgGniN/jpu8ahpeTEhNwAAwPrUPETEnOkOGoHjSz5eh3iai5awtX9jQ I5Jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682324713; x=1684916713; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=j18LTPw/0ZiwBV/EQmierqo28H2NNyEAjpLUZMbxn80=; b=kFvvm1gWA6LYiHdC6Z19uTrJBQR4WTfkpmNDxFxnOZU7wW/YLCR4veJmP9ojBrHiBy e1uuQlpFOgpydtr5QRn+upkZyl3Tyeik0NXC6V5h9TR00pgpeizGbkIzTNzONCR2oit+ J/eOfRm1SK3+mIghOUf4knZf0ku+qbSb/n5x71UbCkTWpbaTXBf7nBeabORhr3lKJTHF Ae5c9jpSNOt6iBkn/dbeheOjgrcLCtzKtEBrpBvOx7gJVPbzeLHdfaku1RGeczzX68mk jxeyWg6RwhrvOaAldNRXZtTreBn7S6gcmc+TgRBYgeI5nfS8gBEWNuM2zOrXtZoyLv+3 PF4g== X-Gm-Message-State: AAQBX9cV8dgk1NYHi14chPN7p70s4jgU1HC+umnNAfESAu3f+B8S6K5v q/U0zjI6GSdQKhiAgpMGH+9A7SamqQN2Vr68HfoPqw== X-Google-Smtp-Source: AKy350a4MUjUHwoBfxED2Pw4cqUKPKubA2JMVCH1vFSwww8z8PN8W5VV4psZGKlLDpTHBQR/gqh8epDpYPGCETmVnoc= X-Received: by 2002:a05:6512:239b:b0:4ea:e5e2:c893 with SMTP id c27-20020a056512239b00b004eae5e2c893mr151496lfv.1.1682324713337; Mon, 24 Apr 2023 01:25:13 -0700 (PDT) MIME-Version: 1.0 References: <000000000000b9915d05f9d98bdd@google.com> <13d484d3-d573-cd82-fff0-a35e27b8451e@oracle.com> <20230424-frucht-beneiden-83a8083a973b@brauner> In-Reply-To: <20230424-frucht-beneiden-83a8083a973b@brauner> From: Dmitry Vyukov Date: Mon, 24 Apr 2023 10:25:00 +0200 Message-ID: Subject: Re: [syzbot] [ext4?] [mm?] KCSAN: data-race in strscpy / strscpy (3) To: Christian Brauner Cc: Mike Christie , Matthew Wilcox , syzbot , adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, llvm@lists.linux.dev, nathan@kernel.org, ndesaulniers@google.com, syzkaller-bugs@googlegroups.com, trix@redhat.com, tytso@mit.edu, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , martin.lau@linux.dev, bpf , KP Singh , Ingo Molnar , Peter Zijlstra Content-Type: text/plain; charset="UTF-8" X-Rspam-User: X-Rspamd-Server: rspam03 X-Stat-Signature: yaak4g9n91n9yykdbifrar16tjcz7oct X-Rspamd-Queue-Id: 49FFCC0004 X-HE-Tag: 1682324714-829469 X-HE-Meta: U2FsdGVkX18e6IQd5JcXY8R9Pe1QwysIeL5v/u4ZTTZGewQJPs+/u2B8Ez07r6O0SwqY7TNOAN4hn4DvQQdoVMtPhlpRyBrjKqUVob3Cl+zfXCT5pfBrWS0EsFpeUvY5xLdEBLDuJv8O6jlMhpd3crnga+u1UQkmDFF+u321PPjVSmwAFxPm3Ycnqz33KBNRncrfwae/Mvd3SL2U5CVc2f4G3429ihxYghSPCtQBMakHh1ZicYK1yzu5Jk/YRIw1edGEGdPPl3AjOt9nVESMQVVryk6kfgILxfSTwUchKrmBUvotSWQeSL0u2hSZ3sv42ahkdp1MKhUbaNiirI3XhguZaHCzLQ3Na3CGXuYEAr/DPOTnQCvPwZgCZ0NM6CZ8S+d+z6Vgtp5UuQVByQFJW+y73kXS4/E8XeQYLgGMNZg8KacX2zRSAsIebBk6m+Dp8oS9Rbh4WwFNJuFd/lYuv+mUxJ1PyayUmiATY+Y3NpLVWdNgTakUqnoxCy86Zn7m1+UF3xMgr2oljd7Ch+01KSIG0xni+3yDjw03Gy8mMHWozSY3hJyPdIwh3CoODrRE9vrAdIGlfdyBfZxGggzJYvtYbdWatOFr0tXryrIJ87irbvUWLM2BM0c/esg6R4RTnxCWoXHFW3OiAOn9slpDFHTHE3XDpO/yQGsr3j4l80QuwNxxNCkkkRwF6S+4f7hxvekSJFn5QvzcqrpYk5rBnGeF1DTxIuQ6pTxwCCol75DPZ/yHEG2OBuUEmIRy/yB0JJbj1D27NYPz1VRIbhiezNsdt9KqfGJ+ahpM6Ig/HAN78/M43oKGGF4ItBr81qKu1WtUxpCyQuL72iV+zd7v24mRmi8UHnZoQYc7s1iN6W0d1gI2Saejt2NcB3ZWsVXegvZQeX49pe0cf06A7alY/hI2DcW81nK871663CRilmGMIMiNpYcz3kYYAlV6wCKDKnZR4ScOF3/C0b/zPJK Kk4HoiKo pGZxETNxDxs+8yedheKmE2ZWLBxcqfWoHJqfPtCe7ShL29cXLu8wjuY6p6rui7lOA14CV6gIEBpYpVp1/DWgkHRLEhtkg3SnQoPAWFE+yFOa+O8NEDh1bjPMQHH0Z5xSOMLlMptyBrUi3zWaGjRxo5bh+ebhILyF2C1hvUokMyDZxoGD90nm0puDDxq8E4iPqgyrSMngo8hraZJSbF9+7JfG2ToyEMhhHcxkelA9Vk05dPlDO0AJMSZQI5g7/mCyS3J1OPVuvD6vXm/7oDNlajNMPRN1+zV9tOqNMwgE7tgc8oAOk4efKTofEW1Qz+5B4dtwqAwocNjBTttR5GizRj5HCKcJBsQorafrPDbzbTW94DOa361Na00MNdvH+xYmUsRj2FhhOIOZ/J7Bre5arEGGnIJWUxshvVBBaR6xNiEuJM5h8EDMR8EzKt1qWIKYSW8qtgxPDiCw6Cds= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, 24 Apr 2023 at 09:59, Christian Brauner wrote: > > On Fri, Apr 21, 2023 at 12:40:45PM -0500, Mike Christie wrote: > > cc'ing Christian, because I might have fixed this with a patch in > > his tree. > > > > On 4/21/23 9:58 AM, Matthew Wilcox wrote: > > > I'm not sure how it is that bpf is able to see the task before comm is > > > initialised; that seems to be the real race here, that comm is not set > > > before the kthread is a schedulable entity? Adding the scheduler people. > > > > > >>> ================================================================== > > >>> BUG: KCSAN: data-race in strscpy / strscpy > > >>> > > >>> write to 0xffff88812ed8b730 of 8 bytes by task 16157 on cpu 1: > > >>> strscpy+0xa9/0x170 lib/string.c:165 > > >>> strscpy_pad+0x27/0x80 lib/string_helpers.c:835 > > >>> __set_task_comm+0x46/0x140 fs/exec.c:1232 > > >>> set_task_comm include/linux/sched.h:1984 [inline] > > >>> __kthread_create_on_node+0x2b2/0x320 kernel/kthread.c:474 > > >>> kthread_create_on_node+0x8a/0xb0 kernel/kthread.c:512 > > >>> ext4_run_lazyinit_thread fs/ext4/super.c:3848 [inline] > > >>> ext4_register_li_request+0x407/0x650 fs/ext4/super.c:3983 > > >>> __ext4_fill_super fs/ext4/super.c:5480 [inline] > > >>> ext4_fill_super+0x3f4a/0x43f0 fs/ext4/super.c:5637 > > >>> get_tree_bdev+0x2b1/0x3a0 fs/super.c:1303 > > >>> ext4_get_tree+0x1c/0x20 fs/ext4/super.c:5668 > > >>> vfs_get_tree+0x51/0x190 fs/super.c:1510 > > >>> do_new_mount+0x200/0x650 fs/namespace.c:3042 > > >>> path_mount+0x498/0xb40 fs/namespace.c:3372 > > >>> do_mount fs/namespace.c:3385 [inline] > > >>> __do_sys_mount fs/namespace.c:3594 [inline] > > >>> __se_sys_mount+0x27f/0x2d0 fs/namespace.c:3571 > > >>> __x64_sys_mount+0x67/0x80 fs/namespace.c:3571 > > >>> do_syscall_x64 arch/x86/entry/common.c:50 [inline] > > >>> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 > > >>> entry_SYSCALL_64_after_hwframe+0x63/0xcd > > >>> > > >>> read to 0xffff88812ed8b733 of 1 bytes by task 16161 on cpu 0: > > >>> strscpy+0xde/0x170 lib/string.c:174 > > >>> ____bpf_get_current_comm kernel/bpf/helpers.c:260 [inline] > > >>> bpf_get_current_comm+0x45/0x70 kernel/bpf/helpers.c:252 > > >>> ___bpf_prog_run+0x281/0x3050 kernel/bpf/core.c:1822 > > >>> __bpf_prog_run32+0x74/0xa0 kernel/bpf/core.c:2043 > > >>> bpf_dispatcher_nop_func include/linux/bpf.h:1124 [inline] > > >>> __bpf_prog_run include/linux/filter.h:601 [inline] > > >>> bpf_prog_run include/linux/filter.h:608 [inline] > > >>> __bpf_trace_run kernel/trace/bpf_trace.c:2263 [inline] > > >>> bpf_trace_run4+0x9f/0x140 kernel/trace/bpf_trace.c:2304 > > >>> __traceiter_sched_switch+0x3a/0x50 include/trace/events/sched.h:222 > > >>> trace_sched_switch include/trace/events/sched.h:222 [inline] > > >>> __schedule+0x7e7/0x8e0 kernel/sched/core.c:6622 > > >>> schedule+0x51/0x80 kernel/sched/core.c:6701 > > >>> schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:6760 > > >>> kthread+0x11c/0x1e0 kernel/kthread.c:369 > > >>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 > > >>> > > > > > > I didn't see the beginning of this thread and I think the part of the > > sysbot report that lists the patches/trees being used got cut off so > > I'm not 100% sure what's in the kernel. > > > > In Linus's current tree we do set_task_comm in __kthread_create_on_node > > after waiting on the kthread_create_info completion which is completed by > > threadd(). At this time, kthread() has already done the complete() on the > > kthread_create_info completion and started to run the threadfn function and > > that could be running. So we can hit the race that way. > > > > > > In linux next, from > > https://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux.git/log/?h=kernel.user_worker > > we have: > > > > commit cf587db2ee0261c74d04f61f39783db88a0b65e4 > > Author: Mike Christie > > Date: Fri Mar 10 16:03:23 2023 -0600 > > > > kernel: Allow a kernel thread's name to be set in copy_process > > > > and so now copy_process() sets the name before the taskfn is started, so we > > shouldn't hit any races like above. > > Yeah, that looks like it should fix it. > > Afaict, this has no reproducer so there's no point in letting syzbot > test on this. I've sent the pull request for the kernel user worker > series on Friday. So I guess we'll see whether it's reproducible on > v6.4-rc1. To see if it still happens to tell syzbot about the fix, then it will remind if it still happens with the fix or not. Otherwise everybody will forget about this tomorrow ;) #syz fix: kernel: Allow a kernel thread's name to be set in copy_process Btw, a similar race will still be possible b/c it's possible to change the name at any point by writing to /proc/self/task/[tid]/comm. But I am not sure how provably dangerous it will be and there is a different attitude towards fixing races proactively for different kernel subsystems, so we will probably not report it.