[PATCH v2] selinux: fix data race on AVC latest_notif

[PATCH v2] selinux: fix data race on AVC latest_notif

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

avc_policy_seqno() reads latest_notif without holding notif_lock, while
avc_latest_notif_update() can update it under that lock. KCSAN reports
these concurrent accesses during policy boolean updates and permission
checks.

Use READ_ONCE() for the lockless read and WRITE_ONCE() for the update.
The spinlock continues to serialize the comparison and update against
other writers. Reads made while holding notif_lock cannot race with a
writer and can remain plain accesses.

This marks both sides of the intentional concurrent access and constrains
compiler transformations, without suppressing checking with data_race().

Fixes: 788e7dd4c22e ("SELinux: Improve read/write performance")
Reported-by: syzbot+a7f7cb0737bd91aa698c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a7f7cb0737bd91aa698c
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
Changes in v2:
- mark the write as well
- drop data_race()
- i am not that familiar with the kernel concurrency model, so an AI
  claimed an RCU read-side critical section would not exclude an
  in-place update of this scalar
v1: https://lore.kernel.org/all/20260202134822.67476-1-cgoettsche@seltendoof.de/T/
 security/selinux/avc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index a9401d6c2e5f..e5d68ab2c331 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -578,7 +578,7 @@ static int avc_latest_notif_update(u32 seqno, int is_insert)
 		}
 	} else {
 		if (seqno > selinux_avc.avc_cache.latest_notif)
-			selinux_avc.avc_cache.latest_notif = seqno;
+			WRITE_ONCE(selinux_avc.avc_cache.latest_notif, seqno);
 	}
 	spin_unlock_irqrestore(&notif_lock, flag);
 
@@ -1203,5 +1203,6 @@ int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
 
 u32 avc_policy_seqno(void)
 {
-	return selinux_avc.avc_cache.latest_notif;
+	/* Writers hold notif_lock; readers only sample the sequence number. */
+	return READ_ONCE(selinux_avc.avc_cache.latest_notif);
 }
-- 
2.55.0

Re: [PATCH v2] selinux: fix data race on AVC latest_notif

[sashiko-bot]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> avc_policy_seqno() reads latest_notif without holding notif_lock, while
> avc_latest_notif_update() can update it under that lock. KCSAN reports
> these concurrent accesses during policy boolean updates and permission
> checks.
> 
> Use READ_ONCE() for the lockless read and WRITE_ONCE() for the update.
> The spinlock continues to serialize the comparison and update against
> other writers. Reads made while holding notif_lock cannot race with a
> writer and can remain plain accesses.
> 
> This marks both sides of the intentional concurrent access and constrains
> compiler transformations, without suppressing checking with data_race().
> 
> Fixes: 788e7dd4c22e ("SELinux: Improve read/write performance")
> Reported-by: syzbot+a7f7cb0737bd91aa698c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a7f7cb0737bd91aa698c
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923101323.2996793-1-cgoettsche@seltendoof.de?part=1

Re: [PATCH v2] selinux: fix data race on AVC latest_notif

[Stephen Smalley]

On Wed, Sep 23, 2026 at 6:13 AM Christian Göttsche
<cgoettsche@seltendoof.de> wrote:
>
> From: Christian Göttsche <cgzones@googlemail.com>
>
> avc_policy_seqno() reads latest_notif without holding notif_lock, while
> avc_latest_notif_update() can update it under that lock. KCSAN reports
> these concurrent accesses during policy boolean updates and permission
> checks.
>
> Use READ_ONCE() for the lockless read and WRITE_ONCE() for the update.
> The spinlock continues to serialize the comparison and update against
> other writers. Reads made while holding notif_lock cannot race with a
> writer and can remain plain accesses.
>
> This marks both sides of the intentional concurrent access and constrains
> compiler transformations, without suppressing checking with data_race().
>
> Fixes: 788e7dd4c22e ("SELinux: Improve read/write performance")
> Reported-by: syzbot+a7f7cb0737bd91aa698c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a7f7cb0737bd91aa698c
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Re: [PATCH v2] selinux: fix data race on AVC latest_notif

[Christian Göttsche]

On Wed, 23 Sept 2026 at 15:21, Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Wed, Sep 23, 2026 at 6:13 AM Christian Göttsche
> <cgoettsche@seltendoof.de> wrote:
> >
> > From: Christian Göttsche <cgzones@googlemail.com>
> >
> > avc_policy_seqno() reads latest_notif without holding notif_lock, while
> > avc_latest_notif_update() can update it under that lock. KCSAN reports
> > these concurrent accesses during policy boolean updates and permission
> > checks.
> >
> > Use READ_ONCE() for the lockless read and WRITE_ONCE() for the update.
> > The spinlock continues to serialize the comparison and update against
> > other writers. Reads made while holding notif_lock cannot race with a
> > writer and can remain plain accesses.
> >
> > This marks both sides of the intentional concurrent access and constrains
> > compiler transformations, without suppressing checking with data_race().
> >
> > Fixes: 788e7dd4c22e ("SELinux: Improve read/write performance")
> > Reported-by: syzbot+a7f7cb0737bd91aa698c@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=a7f7cb0737bd91aa698c
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

With this fixed, there is one syzbot report left:
https://syzkaller.appspot.com/bug?extid=9b95da55ba5146a60734
For me this seems not at all SELinux related, maybe Paul can correct
the tagged subsystem.

Re: [PATCH v2] selinux: fix data race on AVC latest_notif

[Paul Moore]

On Sep 23, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> avc_policy_seqno() reads latest_notif without holding notif_lock, while
> avc_latest_notif_update() can update it under that lock. KCSAN reports
> these concurrent accesses during policy boolean updates and permission
> checks.
> 
> Use READ_ONCE() for the lockless read and WRITE_ONCE() for the update.
> The spinlock continues to serialize the comparison and update against
> other writers. Reads made while holding notif_lock cannot race with a
> writer and can remain plain accesses.
> 
> This marks both sides of the intentional concurrent access and constrains
> compiler transformations, without suppressing checking with data_race().
> 
> Fixes: 788e7dd4c22e ("SELinux: Improve read/write performance")
> Reported-by: syzbot+a7f7cb0737bd91aa698c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a7f7cb0737bd91aa698c
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> Changes in v2:
> - mark the write as well
> - drop data_race()
> - i am not that familiar with the kernel concurrency model, so an AI
>   claimed an RCU read-side critical section would not exclude an
>   in-place update of this scalar
> v1: https://lore.kernel.org/all/20260202134822.67476-1-cgoettsche@seltendoof.de/T/
>  security/selinux/avc.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)

Merged into selinux/stable-7.3 with a stable tag, I'll send this up to
Linus early next week after it has had some time in linux-next.

Thanks!

--
paul-moore.com