From patchwork Wed Feb 19 14:28:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Qian Cai X-Patchwork-Id: 11391609 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5026D92A for ; Wed, 19 Feb 2020 14:28:53 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 12AFC24656 for ; Wed, 19 Feb 2020 14:28:53 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lca.pw header.i=@lca.pw header.b="OvI3GdWa" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 12AFC24656 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=lca.pw Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 328976B0003; Wed, 19 Feb 2020 09:28:52 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 2B22D6B0006; Wed, 19 Feb 2020 09:28:52 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 17A226B0007; Wed, 19 Feb 2020 09:28:52 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0211.hostedemail.com [216.40.44.211]) by kanga.kvack.org (Postfix) with ESMTP id EFCB16B0003 for ; Wed, 19 Feb 2020 09:28:51 -0500 (EST) Received: from smtpin03.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 9E43682499A8 for ; Wed, 19 Feb 2020 14:28:51 +0000 (UTC) X-FDA: 76507108062.03.berry13_4d4ae67b8be21 X-Spam-Summary: 2,0,0,e2794dd93e3e7da1,d41d8cd98f00b204,cai@lca.pw,:paulmck@kernel.org:akpm@linux-foundation.org:kirill@shutemov.name:elver@google.com:peterz@infradead.org::linux-kernel@vger.kernel.org:cai@lca.pw,RULES_HIT:41:355:379:541:800:960:973:988:989:1260:1345:1437:1534:1542:1711:1730:1747:1777:1792:2393:2553:2559:2562:2693:2895:2897:2918:3138:3139:3140:3141:3142:3353:3865:3866:3867:3868:3871:3872:3874:4250:4321:5007:6261:6653:7903:10004:11026:11473:11658:11914:12043:12297:12438:12517:12519:12555:12895:14018:14096:14104:14181:14394:14721:21067:21080:21444:21451:21627:21990:30054:30070:30090,0,RBL:209.85.160.195:@lca.pw:.lbl8.mailshell.net-66.201.201.201 62.14.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:45,LUA_SUMMARY:none X-HE-Tag: berry13_4d4ae67b8be21 X-Filterd-Recvd-Size: 4948 Received: from mail-qt1-f195.google.com (mail-qt1-f195.google.com [209.85.160.195]) by imf35.hostedemail.com (Postfix) with ESMTP for ; Wed, 19 Feb 2020 14:28:51 +0000 (UTC) Received: by mail-qt1-f195.google.com with SMTP id w47so309754qtk.4 for ; Wed, 19 Feb 2020 06:28:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lca.pw; s=google; h=from:to:cc:subject:date:message-id; bh=M/WOQ4dpD5ui5gn3HK5r3YR0sSK5JjTGZgiU8nuYjiY=; b=OvI3GdWaULkHM6L7NQNGiL1tt+87WC0aV1sO7nxEF6vXn1H1/McHlo6NEux0NpiDAE eXuxxl8CwvjBJoNkxUgLeXRQ4aM8Oohu6ZPrDF3WYVmrlm/ogr5eim0ZUrec2+Q3qq/A 0szU0cwq2GMLj1y3zeR4BqAxDsbGXtzzp20Uc8506FOtPqSaBESxQc41R7gvT6ME+Yhh SPMHj4NjfddXYPjXpKc+9s39XhceWqbDYjFYErdd3LRFzIkYWqvfrokwF4C0kgYTXAjm 4tGwt6qg4BPCS9o+GOkTe8X1NPkW6IX5oZ6miDSXl4NnrrBCciCnMCUEwoTTj2T1nlR1 VrlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=M/WOQ4dpD5ui5gn3HK5r3YR0sSK5JjTGZgiU8nuYjiY=; b=gyc3qNCjQTdISnPWFjxlzV+eWRvtxu8I0u6T92jjgQdbjavV0DoNcykDxC1aAz35T0 wWokJ/8kj9o/9Oq3Jx6QDN9cEeJbMSnXqa7db4Ggus5+F9zifFHGvfreC6juHJ5TkENp 7kR2D7STb78874C8+zvUTSJcJ+lY/asQKSrhuNAF0nIg1Pj9jn7/fuEOsjpvgrhCvX/3 X5UiWdlHd8mMuxNaIT1DSFrWPmYx6AIr/e+z/NP++Pv+F+Kh33LkrEOzmBgnYD2sgTNO PeUVyLKvhyHf9Jq9IvY8MmEWn3IjfVUqEUgDCUd57HNsYOt8vLQOB1/nr2kwjh+VnBAg Ntew== X-Gm-Message-State: APjAAAVdCU76XihiJ0OjolfiK0PpmN76X2zClI6Vc+WBK5yIhRiTUxiO 9g6DN1eO8QczVLxzs89mfcsLVA== X-Google-Smtp-Source: APXvYqxF8mlRubt5qpCY+pnwXt0503TztKUdTJaSgYBmvl0/fQkuGgmQdfDCtpU4CZp7L7c9IZpvfg== X-Received: by 2002:ac8:7765:: with SMTP id h5mr22389403qtu.223.1582122530154; Wed, 19 Feb 2020 06:28:50 -0800 (PST) Received: from qcai.nay.com (nat-pool-bos-t.redhat.com. [66.187.233.206]) by smtp.gmail.com with ESMTPSA id c26sm57012qtn.19.2020.02.19.06.28.48 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Feb 2020 06:28:49 -0800 (PST) From: Qian Cai To: paulmck@kernel.org Cc: akpm@linux-foundation.org, kirill@shutemov.name, elver@google.com, peterz@infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Qian Cai Subject: [PATCH -next v2] fork: annotate a data race in vm_area_dup() Date: Wed, 19 Feb 2020 09:28:15 -0500 Message-Id: <1582122495-12885-1-git-send-email-cai@lca.pw> X-Mailer: git-send-email 1.8.3.1 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000011, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: struct vm_area_struct could be accessed concurrently as noticed by KCSAN, write to 0xffff9cf8bba08ad8 of 8 bytes by task 14263 on cpu 35: vma_interval_tree_insert+0x101/0x150: rb_insert_augmented_cached at include/linux/rbtree_augmented.h:58 (inlined by) vma_interval_tree_insert at mm/interval_tree.c:23 __vma_link_file+0x6e/0xe0 __vma_link_file at mm/mmap.c:629 vma_link+0xa2/0x120 mmap_region+0x753/0xb90 do_mmap+0x45c/0x710 vm_mmap_pgoff+0xc0/0x130 ksys_mmap_pgoff+0x1d1/0x300 __x64_sys_mmap+0x33/0x40 do_syscall_64+0x91/0xc44 entry_SYSCALL_64_after_hwframe+0x49/0xbe read to 0xffff9cf8bba08a80 of 200 bytes by task 14262 on cpu 122: vm_area_dup+0x6a/0xe0 vm_area_dup at kernel/fork.c:362 __split_vma+0x72/0x2a0 __split_vma at mm/mmap.c:2661 split_vma+0x5a/0x80 mprotect_fixup+0x368/0x3f0 do_mprotect_pkey+0x263/0x420 __x64_sys_mprotect+0x51/0x70 do_syscall_64+0x91/0xc44 entry_SYSCALL_64_after_hwframe+0x49/0xbe vm_area_dup() blindly copies all fields of original VMA to the new one. This includes coping vm_area_struct::shared.rb which is normally protected by i_mmap_lock. But this is fine because the read value will be overwritten on the following __vma_link_file() under proper protection. Thus, mark it as an intentional data race and insert a few assertions for the fields that should not be modified concurrently. Signed-off-by: Qian Cai Acked-by: Kirill A. Shutemov --- v2: Insert a few assertions thanks to Marco. Update the commit log thanks to Kirill. kernel/fork.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index cb2ae49e497e..67a5d691ffa8 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -359,7 +359,13 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); if (new) { - *new = *orig; + ASSERT_EXCLUSIVE_WRITER(orig->vm_flags); + ASSERT_EXCLUSIVE_WRITER(orig->vm_file); + /* + * orig->shared.rb may be modified concurrently, but the clone + * will be reinitialized. + */ + *new = data_race(*orig); INIT_LIST_HEAD(&new->anon_vma_chain); new->vm_next = new->vm_prev = NULL; }