+ taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch added to mm-nonmm-unstable branch

+ taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch added to mm-nonmm-unstable branch

[Andrew Morton]

The patch titled
     Subject: taskstats: copy signal->stats under siglock in taskstats_exit
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Bradley Morgan <include@grrlz.net>
Subject: taskstats: copy signal->stats under siglock in taskstats_exit
Date: Tue, 4 Aug 2026 09:34:00 +0000

taskstats_exit() copies tsk->signal->stats into the exit reply without
taking any lock.  Every other writer of this struct holds sighand->siglock
before touching it, and this copy does not.

The copy happens on the last thread of a thread group that exits. 
group_dead being 1 only says that every thread has dropped signal->live,
it does not say how far the other threads got in do_exit().  One of them
can still be inside fill_tgid_exit() adding its counters to the struct
while the last thread copies it out, so the copy can read the struct in
the middle of an update.

The commit that added the copy assumed no locking was needed because the
group was dead:

	/* No locking needed for tsk->signal->stats since
	   group is dead */

but at that point the other threads have not necessarily finished
their exit path.

cpu0 (thread A, not last)        cpu1 (thread B, last)
===========================      ==============================
atomic_dec(&signal->live)        atomic_dec(&signal->live) -> 0
group_dead = 0                   group_dead = 1
...                              taskstats_exit(tsk, 1)
taskstats_exit(tsk, 0)           fill_tgid_exit(tsk) [siglock]
fill_tgid_exit(tsk)              memcpy(stats, signal->stats)
  spin_lock(siglock)               reads ac_utime (new)
  stats->ac_utime += x             reads ac_stime (old)
  stats->ac_stime += y             torn snapshot -> netlink
  spin_unlock(siglock)

The listeners receive a partially updated tgid snapshot, with some fields
from before the concurrent update and some from after.  There is no crash
or splat, which is likely why this went unnoticed since 2006.  A userspace
model of the same shape, writer under a lock and a lockless memcpy reader,
produces millions of torn reads in a few seconds.

Take siglock around the copy like every other access does.  sighand is
still alive here because taskstats_exit() runs before exit_notify(), and
fill_tgid_exit() already takes this same lock earlier in this function.

Link: https://lore.kernel.org/20260804093400.3922-1-include@grrlz.net
Fixes: ad4ecbcba728 ("[PATCH] delay accounting taskstats interface send tgid once")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Cc: Balbir Singh <bsingharora@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 kernel/taskstats.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/kernel/taskstats.c~taskstats-copy-signal-stats-under-siglock-in-taskstats_exit
+++ a/kernel/taskstats.c
@@ -590,6 +590,7 @@ void taskstats_exit(struct task_struct *
 	struct sk_buff *rep_skb;
 	size_t size;
 	int is_thread_group;
+	unsigned long flags;
 
 	if (!family_registered)
 		return;
@@ -635,7 +636,10 @@ void taskstats_exit(struct task_struct *
 	if (!stats)
 		goto err;
 
+	/* This was racy before, copy the stats under siglock. */
+	spin_lock_irqsave(&tsk->sighand->siglock, flags);
 	memcpy(stats, tsk->signal->stats, sizeof(*stats));
+	spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
 	stats->version = TASKSTATS_VERSION;
 
 send:
_

Patches currently in -mm which might be from include@grrlz.net are

taskstats-drop-the-dead-null-attribute-check-in-parse.patch
taskstats-fold-the-two-cpumask-handlers-into-one.patch
taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch

Re: + taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch added to mm-nonmm-unstable branch

[Oleg Nesterov]

On 08/04, Andrew Morton wrote:
>
> From: Bradley Morgan <include@grrlz.net>
> Subject: taskstats: copy signal->stats under siglock in taskstats_exit

...

> --- a/kernel/taskstats.c~taskstats-copy-signal-stats-under-siglock-in-taskstats_exit
> +++ a/kernel/taskstats.c
> @@ -590,6 +590,7 @@ void taskstats_exit(struct task_struct *
>  	struct sk_buff *rep_skb;
>  	size_t size;
>  	int is_thread_group;
> +	unsigned long flags;
>  
>  	if (!family_registered)
>  		return;
> @@ -635,7 +636,10 @@ void taskstats_exit(struct task_struct *
>  	if (!stats)
>  		goto err;
>  
> +	/* This was racy before, copy the stats under siglock. */
> +	spin_lock_irqsave(&tsk->sighand->siglock, flags);

Why _irqsave? The only caller is do_exit(), and it obviously runs with
irqs enabled?

Oleg.

Re: + taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch added to mm-nonmm-unstable branch

[Bradley Morgan]

On 4 August 2026 21:39:23 BST, Oleg Nesterov <oleg@redhat.com> wrote:
>On 08/04, Andrew Morton wrote:
>>
>> From: Bradley Morgan <include@grrlz.net>
>> Subject: taskstats: copy signal->stats under siglock in taskstats_exit
>
>...
>
>> ---
>a/kernel/taskstats.c~taskstats-copy-signal-stats-under-siglock-in-taskstats_exit
>> +++ a/kernel/taskstats.c
>> @@ -590,6 +590,7 @@ void taskstats_exit(struct task_struct *
>>  	struct sk_buff *rep_skb;
>>  	size_t size;
>>  	int is_thread_group;
>> +	unsigned long flags;
>>  
>>  	if (!family_registered)
>>  		return;
>> @@ -635,7 +636,10 @@ void taskstats_exit(struct task_struct *
>>  	if (!stats)
>>  		goto err;
>>  
>> +	/* This was racy before, copy the stats under siglock. */
>> +	spin_lock_irqsave(&tsk->sighand->siglock, flags);
>
>Why _irqsave? The only caller is do_exit(), and it obviously runs with
>irqs enabled?
>
>Oleg.
>
>


Thanks for the review, how's this?

From 137b873cce7721384c9d24f4c0864bb002c8d039 Mon Sep 17 00:00:00 2001
From: Bradley Morgan <include@grrlz.net>
Date: Tue, 4 Aug 2026 09:34:00 +0000
Subject: [PATCH v2] taskstats: copy signal->stats under siglock in
 taskstats_exit

taskstats_exit() copies tsk->signal->stats into the exit reply
without taking any lock. Every other writer of this struct holds
sighand->siglock before touching it, and this copy does not.

The copy happens on the last thread of a thread group that exits.
group_dead being 1 only says that every thread has dropped
signal->live, it does not say how far the other threads got in
do_exit(). One of them can still be inside fill_tgid_exit() adding
its counters to the struct while the last thread copies it out, so
the copy can read the struct in the middle of an update.

The commit that added the copy assumed no locking was needed because
the group was dead:

	/* No locking needed for tsk->signal->stats since
	   group is dead */

but at that point the other threads have not necessarily finished
their exit path.

cpu0 (thread A, not last)        cpu1 (thread B, last)
===========================      ==============================
atomic_dec(&signal->live)        atomic_dec(&signal->live) -> 0
group_dead = 0                   group_dead = 1
...                              taskstats_exit(tsk, 1)
taskstats_exit(tsk, 0)           fill_tgid_exit(tsk) [siglock]
fill_tgid_exit(tsk)              memcpy(stats, signal->stats)
  spin_lock(siglock)               reads ac_utime (new)
  stats->ac_utime += x             reads ac_stime (old)
  stats->ac_stime += y             torn snapshot -> netlink
  spin_unlock(siglock)

The listeners receive a partially updated tgid snapshot, with some
fields from before the concurrent update and some from after. There
is no crash or splat, which is likely why this went unnoticed since
2006. A userspace model of the same shape, writer under a lock and
a lockless memcpy reader, produces millions of torn reads in a few
seconds.

Take siglock around the copy like every other access does. sighand
is still alive here because taskstats_exit() runs before
exit_notify(), and fill_tgid_exit() already takes this same lock
earlier in this function.

Fixes: ad4ecbcba728 ("[PATCH] delay accounting taskstats interface send tgid once")
Signed-off-by: Bradley Morgan <include@grrlz.net>

The only caller is do_exit(), which runs with irqs enabled, and
fill_tgid_exit() already takes the same lock with spin_lock_irq().
Use that instead of spin_lock_irqsave(). (Oleg)

---
Changes since V1:
- spin_lock_irq() instead of spin_lock_irqsave() (Oleg)
---
 kernel/taskstats.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index f31df72f0e9d..300fa06ac84a 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -635,7 +635,10 @@ void taskstats_exit(struct task_struct *tsk, int group_dead)
 	if (!stats)
 		goto err;
 
+	/* This was racy before, copy the stats under siglock. */
+	spin_lock_irq(&tsk->sighand->siglock);
 	memcpy(stats, tsk->signal->stats, sizeof(*stats));
+	spin_unlock_irq(&tsk->sighand->siglock);
 	stats->version = TASKSTATS_VERSION;
 
 send:
-- 
2.47.3

Thanks!

Re: + taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch added to mm-nonmm-unstable branch

[Oleg Nesterov]

On 08/04, Bradley Morgan wrote:
>
> cpu0 (thread A, not last)        cpu1 (thread B, last)
> ===========================      ==============================
> atomic_dec(&signal->live)        atomic_dec(&signal->live) -> 0
> group_dead = 0                   group_dead = 1
> ...                              taskstats_exit(tsk, 1)
> taskstats_exit(tsk, 0)           fill_tgid_exit(tsk) [siglock]
> fill_tgid_exit(tsk)              memcpy(stats, signal->stats)
>   spin_lock(siglock)               reads ac_utime (new)
>   stats->ac_utime += x             reads ac_stime (old)
>   stats->ac_stime += y             torn snapshot -> netlink
>   spin_unlock(siglock)
>
> The listeners receive a partially updated tgid snapshot, with some
> fields from before the concurrent update and some from after. There
> is no crash or splat, which is likely why this went unnoticed since
> 2006. A userspace model of the same shape, writer under a lock and
> a lockless memcpy reader, produces millions of torn reads in a few
> seconds.
>
> Take siglock around the copy like every other access does. sighand
> is still alive here because taskstats_exit() runs before
> exit_notify(), and fill_tgid_exit() already takes this same lock
> earlier in this function.

Acked-by: Oleg Nesterov <oleg@redhat.com>

However. I won't blame your fix, but I am not sure it actually fixes the
real problem.

In the scenario above, if thread B takes ->siglock first (before thread A)
it will report TASKSTATS_TYPE_TGID/AGROUP without accounting thread A.
Looks "obviously wrong" but I forgot everything about taskstats.

And OTOH... for_each_thread() in fill_stats_for_tgid() can't rely on the
tsk->exit_state check, the same thread can be accounted twice.

Oleg.