[PATCH v2] cred: annotate data race on non_rcu when copying a cred

[PATCH v2] cred: annotate data race on non_rcu when copying a cred

[Babanpreet Singh]

prepare_creds() copies the current cred while another task can be in
get_cred() on it, clearing non_rcu. KCSAN reports:

  BUG: KCSAN: data-race in io_prep_async_work / prepare_creds

  write to 0xffff8881046cea68 of 4 bytes by task 3646 on cpu 1:
   get_cred_many include/linux/cred.h:222 [inline]
   get_cred include/linux/cred.h:238 [inline]
   io_prep_async_work+0x9b/0x3c0 io_uring/io_uring.c:367

  read to 0xffff8881046ce9c0 of 184 bytes by task 3645 on cpu 0:
   prepare_creds+0x71/0x550 kernel/cred.c:192

The race is harmless. non_rcu and usage are the only fields that change
on a published cred, and both are reset on the new cred right after the
copy.

Annotate the copy with data_race(). prepare_kernel_cred() makes the
same copy, so annotate it too and switch it to memcpy() to match.

Reported-by: syzbot+ee58b040032d8bed63d9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ee58b040032d8bed63d9
Reported-by: syzbot+557fdc985d6ac3831e14@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=557fdc985d6ac3831e14
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
---
Drafted with Claude, an LLM coding assistant, from the syzbot reports.

 kernel/cred.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/kernel/cred.c b/kernel/cred.c
index d01df40a9a386..d9ab1cb4230a8 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -189,7 +189,12 @@ struct cred *prepare_creds(void)
 	kdebug("prepare_creds() alloc %p", new);
 
 	old = task->cred;
-	memcpy(new, old, sizeof(struct cred));
+	/*
+	 * Another task can be in get_cred() on the old cred, clearing
+	 * non_rcu. That and usage are the only fields that change on a
+	 * published cred, and both are set fresh below.
+	 */
+	data_race(memcpy(new, old, sizeof(struct cred)));
 
 	new->non_rcu = 0;
 	atomic_long_set(&new->usage, 1);
@@ -573,7 +578,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
 
 	old = get_task_cred(daemon);
 
-	*new = *old;
+	/* Same race as in prepare_creds(). */
+	data_race(memcpy(new, old, sizeof(struct cred)));
 	new->non_rcu = 0;
 	atomic_long_set(&new->usage, 1);
 	get_uid(new->user);

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.54.0 (Apple Git-157)

Re: [PATCH v2] cred: annotate data race on non_rcu when copying a cred

[sashiko-bot]

> prepare_creds() copies the current cred while another task can be in
> get_cred() on it, clearing non_rcu. KCSAN reports:
> 
>   BUG: KCSAN: data-race in io_prep_async_work / prepare_creds
> 
>   write to 0xffff8881046cea68 of 4 bytes by task 3646 on cpu 1:
>    get_cred_many include/linux/cred.h:222 [inline]
>    get_cred include/linux/cred.h:238 [inline]
>    io_prep_async_work+0x9b/0x3c0 io_uring/io_uring.c:367
> 
>   read to 0xffff8881046ce9c0 of 184 bytes by task 3645 on cpu 0:
>    prepare_creds+0x71/0x550 kernel/cred.c:192
> 
> The race is harmless. non_rcu and usage are the only fields that change
> on a published cred, and both are reset on the new cred right after the
> copy.
> 
> Annotate the copy with data_race(). prepare_kernel_cred() makes the
> same copy, so annotate it too and switch it to memcpy() to match.
> 
> Reported-by: syzbot+ee58b040032d8bed63d9@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ee58b040032d8bed63d9
> Reported-by: syzbot+557fdc985d6ac3831e14@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=557fdc985d6ac3831e14
> Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114052900.7-1-bbnpreetsingh@gmail.com?part=1

Re: [PATCH v2] cred: annotate data race on non_rcu when copying a cred

[Bradley Morgan]

On 14 November 2026 05:29:00 GMT, Babanpreet Singh
<bbnpreetsingh@gmail.com> wrote:
>prepare_creds() copies the current cred while another task can be in
>get_cred() on it, clearing non_rcu. KCSAN reports:
>
>  BUG: KCSAN: data-race in io_prep_async_work / prepare_creds
>
>  write to 0xffff8881046cea68 of 4 bytes by task 3646 on cpu 1:
>   get_cred_many include/linux/cred.h:222 [inline]
>   get_cred include/linux/cred.h:238 [inline]
>   io_prep_async_work+0x9b/0x3c0 io_uring/io_uring.c:367
>
>  read to 0xffff8881046ce9c0 of 184 bytes by task 3645 on cpu 0:
>   prepare_creds+0x71/0x550 kernel/cred.c:192
>
>The race is harmless. non_rcu and usage are the only fields that change
>on a published cred, and both are reset on the new cred right after the
>copy.
>
>Annotate the copy with data_race(). prepare_kernel_cred() makes the
>same copy, so annotate it too and switch it to memcpy() to match.

Yes yes, good now.

Reviewed-by: Bradley Morgan <bradley.morgan@linux.dev>


>
>Reported-by: syzbot+ee58b040032d8bed63d9@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=ee58b040032d8bed63d9
>Reported-by: syzbot+557fdc985d6ac3831e14@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=557fdc985d6ac3831e14
>Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
>---
>Drafted with Claude, an LLM coding assistant, from the syzbot reports.
>
> kernel/cred.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
>diff --git a/kernel/cred.c b/kernel/cred.c
>index d01df40a9a386..d9ab1cb4230a8 100644
>--- a/kernel/cred.c
>+++ b/kernel/cred.c
>@@ -189,7 +189,12 @@ struct cred *prepare_creds(void)
> 	kdebug("prepare_creds() alloc %p", new);
> 
> 	old = task->cred;
>-	memcpy(new, old, sizeof(struct cred));
>+	/*
>+	 * Another task can be in get_cred() on the old cred, clearing
>+	 * non_rcu. That and usage are the only fields that change on a
>+	 * published cred, and both are set fresh below.
>+	 */
>+	data_race(memcpy(new, old, sizeof(struct cred)));
> 
> 	new->non_rcu = 0;
> 	atomic_long_set(&new->usage, 1);
>@@ -573,7 +578,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
> 
> 	old = get_task_cred(daemon);
> 
>-	*new = *old;
>+	/* Same race as in prepare_creds(). */
>+	data_race(memcpy(new, old, sizeof(struct cred)));
> 	new->non_rcu = 0;
> 	atomic_long_set(&new->usage, 1);
> 	get_uid(new->user);
>
>base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
>

--- Thanks!