[PATCH v2] cred: annotate data race on non_rcu when copying a cred

[Babanpreet Singh <bbnpreetsingh@gmail.com>]

prepare_creds() copies the current cred while another task can be in
get_cred() on it, clearing non_rcu. KCSAN reports:

  BUG: KCSAN: data-race in io_prep_async_work / prepare_creds

  write to 0xffff8881046cea68 of 4 bytes by task 3646 on cpu 1:
   get_cred_many include/linux/cred.h:222 [inline]
   get_cred include/linux/cred.h:238 [inline]
   io_prep_async_work+0x9b/0x3c0 io_uring/io_uring.c:367

  read to 0xffff8881046ce9c0 of 184 bytes by task 3645 on cpu 0:
   prepare_creds+0x71/0x550 kernel/cred.c:192

The race is harmless. non_rcu and usage are the only fields that change
on a published cred, and both are reset on the new cred right after the
copy.

Annotate the copy with data_race(). prepare_kernel_cred() makes the
same copy, so annotate it too and switch it to memcpy() to match.

Reported-by: syzbot+ee58b040032d8bed63d9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ee58b040032d8bed63d9
Reported-by: syzbot+557fdc985d6ac3831e14@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=557fdc985d6ac3831e14
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
---
Drafted with Claude, an LLM coding assistant, from the syzbot reports.

 kernel/cred.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/kernel/cred.c b/kernel/cred.c
index d01df40a9a386..d9ab1cb4230a8 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -189,7 +189,12 @@ struct cred *prepare_creds(void)
 	kdebug("prepare_creds() alloc %p", new);
 
 	old = task->cred;
-	memcpy(new, old, sizeof(struct cred));
+	/*
+	 * Another task can be in get_cred() on the old cred, clearing
+	 * non_rcu. That and usage are the only fields that change on a
+	 * published cred, and both are set fresh below.
+	 */
+	data_race(memcpy(new, old, sizeof(struct cred)));
 
 	new->non_rcu = 0;
 	atomic_long_set(&new->usage, 1);
@@ -573,7 +578,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
 
 	old = get_task_cred(daemon);
 
-	*new = *old;
+	/* Same race as in prepare_creds(). */
+	data_race(memcpy(new, old, sizeof(struct cred)));
 	new->non_rcu = 0;
 	atomic_long_set(&new->usage, 1);
 	get_uid(new->user);

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.54.0 (Apple Git-157)