From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AA41C35242 for ; Fri, 14 Feb 2020 20:33:41 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0F4E924649 for ; Fri, 14 Feb 2020 20:33:40 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lca.pw header.i=@lca.pw header.b="sjIUvkrE" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0F4E924649 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=lca.pw Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 7047E6B0678; Fri, 14 Feb 2020 15:33:40 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 6B58E6B0679; Fri, 14 Feb 2020 15:33:40 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5CB6F6B067A; Fri, 14 Feb 2020 15:33:40 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 42B386B0678 for ; Fri, 14 Feb 2020 15:33:40 -0500 (EST) Received: from smtpin09.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id D6229181AEF09 for ; Fri, 14 Feb 2020 20:33:39 +0000 (UTC) X-FDA: 76489883358.09.paste59_3cfdaadb3e100 X-HE-Tag: paste59_3cfdaadb3e100 X-Filterd-Recvd-Size: 4496 Received: from mail-qt1-f194.google.com (mail-qt1-f194.google.com [209.85.160.194]) by imf15.hostedemail.com (Postfix) with ESMTP for ; Fri, 14 Feb 2020 20:33:38 +0000 (UTC) Received: by mail-qt1-f194.google.com with SMTP id k7so7827884qth.11 for ; Fri, 14 Feb 2020 12:33:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lca.pw; s=google; h=from:to:cc:subject:date:message-id; bh=utuuKup5LPG796OspCxT2KOedNLQisnMmifEVidt+tA=; b=sjIUvkrE9OQgMUIDitVEp37YqU2yJhK8JAzMi9of98q4BS8b5IUla33MvC49S7FPQn eMu+4QizwQK4DKvwM2ByOMRATGQv9tjlG4ChxzZdwKKqQ9KTiQDfgm92d9q3zNyKPZ/K O/FAde970kkXvyahHPJMZKw5aKBX9YwQSulTCD6kL7zwk+YULf+VbhYpFtlz4J7rNRWY pGu8Mh5fxhdJSaSA78adT8bLU2DOnpVoVTW+IRmT53h/elKdizX7INy4xdv69FE38EK0 Wv4U8hhh31hiswvLH5EMHRjWaThyar9rTZ2zmea4QYNP1TLnqivImZnS+Ph105rqXY/b vpOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=utuuKup5LPG796OspCxT2KOedNLQisnMmifEVidt+tA=; b=ResSSRN6vK28g3tdlVzcQmzZ9ZLr04ShMcCTEUbBwkVPEg5PWeh6Y/hOlgMV6IHWql PI/CkItLQ88nqq5Po/6eoB4nVMnPLaYfvOuEe/ALN9NfZBCJR+/MV5YMYJNX7ajVxZMP sm5mQUD4ts5EmmiWDjgi6X+0pdaFQ2Nvxg48c7kYdm1r8wpYEtc3cbmC3e3t2i4f35/M ZDd5keIkpyz89XUWZA9EjkptoESadd/hHt5q0/9CpO3jr0joheOMAsQ2RnNKy97vczZs 7SCn3T/xoQszCNYBJETy/vrdbZJFPo2VilgezoAxR8dsFaIi6fLu7Vw9WZlZFDU+bpR6 7PSQ== X-Gm-Message-State: APjAAAW0KTPevVFkF8Zk5P+1ainpZXym0zowKP9LtuIqGuolJ/K+99Tf QKufB7BdK3ZAh9vNaMDZzAOlUw== X-Google-Smtp-Source: APXvYqzp0yEutPBy8OYKLKKPHZiW/W3QbOXwwJbuUuTg+0yaqq+Km4hVxuoJ2ybYHCYhE2i+2V0wQQ== X-Received: by 2002:ac8:7392:: with SMTP id t18mr3874950qtp.332.1581712418467; Fri, 14 Feb 2020 12:33:38 -0800 (PST) Received: from qcai.nay.com (nat-pool-bos-t.redhat.com. [66.187.233.206]) by smtp.gmail.com with ESMTPSA id l184sm3926233qkc.107.2020.02.14.12.33.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 14 Feb 2020 12:33:37 -0800 (PST) From: Qian Cai To: akpm@linux-foundation.org Cc: elver@google.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Qian Cai Subject: [PATCH -next] fork: annotate a data race in vm_area_dup() Date: Fri, 14 Feb 2020 15:33:23 -0500 Message-Id: <1581712403-27243-1-git-send-email-cai@lca.pw> X-Mailer: git-send-email 1.8.3.1 X-Bogosity: Ham, tests=bogofilter, spamicity=0.042640, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: struct vm_area_struct could be accessed concurrently as noticed by KCSAN, write to 0xffff9cf8bba08ad8 of 8 bytes by task 14263 on cpu 35: vma_interval_tree_insert+0x101/0x150: rb_insert_augmented_cached at include/linux/rbtree_augmented.h:58 (inlined by) vma_interval_tree_insert at mm/interval_tree.c:23 __vma_link_file+0x6e/0xe0 __vma_link_file at mm/mmap.c:629 vma_link+0xa2/0x120 mmap_region+0x753/0xb90 do_mmap+0x45c/0x710 vm_mmap_pgoff+0xc0/0x130 ksys_mmap_pgoff+0x1d1/0x300 __x64_sys_mmap+0x33/0x40 do_syscall_64+0x91/0xc44 entry_SYSCALL_64_after_hwframe+0x49/0xbe read to 0xffff9cf8bba08a80 of 200 bytes by task 14262 on cpu 122: vm_area_dup+0x6a/0xe0 vm_area_dup at kernel/fork.c:362 __split_vma+0x72/0x2a0 __split_vma at mm/mmap.c:2661 split_vma+0x5a/0x80 mprotect_fixup+0x368/0x3f0 do_mprotect_pkey+0x263/0x420 __x64_sys_mprotect+0x51/0x70 do_syscall_64+0x91/0xc44 entry_SYSCALL_64_after_hwframe+0x49/0xbe The write is holding mmap_sem while changing vm_area_struct.shared.rb. Even though the read is lockless while making a copy, the clone will have its own shared.rb reinitialized. Thus, mark it as an intentional data race using the data_race() macro. Signed-off-by: Qian Cai --- kernel/fork.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index 41f784b6203a..81bdc6e8a6cf 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -359,7 +359,11 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); if (new) { - *new = *orig; + /* + * @orig may be modified concurrently, but the clone will be + * reinitialized. + */ + *new = data_race(*orig); INIT_LIST_HEAD(&new->anon_vma_chain); } return new; -- 1.8.3.1