From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from latitanza.investici.org (latitanza.investici.org [185.218.207.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 367B0175A62 for ; Tue, 4 Aug 2026 09:34:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.218.207.228 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785836057; cv=none; b=rGL0XkOP9uoxVi+m9liG5rD+73PW9I/mdrMKhnIo+lzgenbKkY8YhELhoMQ+aP7LdahXIcwP5CgVqNuMBrA44qLsXM8H8VB3UV+Fyg/eK2DdPum7VM3dm4qMv9nsHwnnl74P2Pf3K/mn49V+rIGvu5ei5QlA2tDS1HYCxsWF/8g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785836057; c=relaxed/simple; bh=Uv5uYaJjTvSRKF0lQpSFt69/l7K7WX/lN/fOtY8MQvc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=J4SD90sv5uNNzwcU7q8xeetd6L97ghfkGf9XbsVuZ9pxErnr6blRaJY1X9rgc8+lGarm4zEUtv+a9AvvKAiu6ePqZIb3ASy1kmZA+4hOF+HHQwy4XfTLLpFfEYxx9dtURUd6fk8oZ/rs0JxA/iDXbYcaMu5Fo4zLuMfxMB2DhMM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=grrlz.net; spf=pass smtp.mailfrom=grrlz.net; dkim=pass (1024-bit key) header.d=grrlz.net header.i=@grrlz.net header.b=E49BCsVv; arc=none smtp.client-ip=185.218.207.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=grrlz.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=grrlz.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=grrlz.net header.i=@grrlz.net header.b="E49BCsVv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=grrlz.net; s=stigmate; t=1785836045; bh=oiPxh27fBGnmiTcVFfr6ctT1LFaEHoSRKqRN9QumPSQ=; h=From:To:Cc:Subject:Date:From; b=E49BCsVvBAwwN/DSB2OqDqj2RRHAPjYTU294E+F2xOFdhxCcIB7skvUkhRzNyHWX4 IKSvH39J9DeOR4M65mart9Dkxl5TBnJYo8SE24Lg2Cxsdju9+nfUtdZtDYHzL3lR0O oeIwQvV167Qm4+Psc3uj7eSGD4JcASP8K0gREXds= Received: from mx3.investici.org (unknown [127.0.0.1]) by latitanza.investici.org (Postfix) with UTF8SMTP id 4hDpJs3r8wzGp97; Tue, 04 Aug 2026 09:34:05 +0000 (UTC) Received: by mx3.investici.org (Postfix) id 4hDpJs1PlvzGp98; Tue, 04 Aug 2026 09:34:05 +0000 (UTC) From: Bradley Morgan To: bsingharora@gmail.com, akpm@linux-foundation.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] taskstats: copy signal->stats under siglock in taskstats_exit Date: Tue, 4 Aug 2026 09:34:00 +0000 Message-ID: <20260804093400.3922-1-include@grrlz.net> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit taskstats_exit() copies tsk->signal->stats into the exit reply without taking any lock. Every other writer of this struct holds sighand->siglock before touching it, and this copy does not. The copy happens on the last thread of a thread group that exits. group_dead being 1 only says that every thread has dropped signal->live, it does not say how far the other threads got in do_exit(). One of them can still be inside fill_tgid_exit() adding its counters to the struct while the last thread copies it out, so the copy can read the struct in the middle of an update. The commit that added the copy assumed no locking was needed because the group was dead: /* No locking needed for tsk->signal->stats since group is dead */ but at that point the other threads have not necessarily finished their exit path. cpu0 (thread A, not last) cpu1 (thread B, last) =========================== ============================== atomic_dec(&signal->live) atomic_dec(&signal->live) -> 0 group_dead = 0 group_dead = 1 ... taskstats_exit(tsk, 1) taskstats_exit(tsk, 0) fill_tgid_exit(tsk) [siglock] fill_tgid_exit(tsk) memcpy(stats, signal->stats) spin_lock(siglock) reads ac_utime (new) stats->ac_utime += x reads ac_stime (old) stats->ac_stime += y torn snapshot -> netlink spin_unlock(siglock) The listeners receive a partially updated tgid snapshot, with some fields from before the concurrent update and some from after. There is no crash or splat, which is likely why this went unnoticed since 2006. A userspace model of the same shape, writer under a lock and a lockless memcpy reader, produces millions of torn reads in a few seconds. Take siglock around the copy like every other access does. sighand is still alive here because taskstats_exit() runs before exit_notify(), and fill_tgid_exit() already takes this same lock earlier in this function. Fixes: ad4ecbcba728 ("[PATCH] delay accounting taskstats interface send tgid once") Signed-off-by: Bradley Morgan --- kernel/taskstats.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/taskstats.c b/kernel/taskstats.c index f31df72f0e9d..9a48827e22bc 100644 --- a/kernel/taskstats.c +++ b/kernel/taskstats.c @@ -590,6 +590,7 @@ void taskstats_exit(struct task_struct *tsk, int group_dead) struct sk_buff *rep_skb; size_t size; int is_thread_group; + unsigned long flags; if (!family_registered) return; @@ -635,7 +636,10 @@ void taskstats_exit(struct task_struct *tsk, int group_dead) if (!stats) goto err; + /* This was racy before, copy the stats under siglock. */ + spin_lock_irqsave(&tsk->sighand->siglock, flags); memcpy(stats, tsk->signal->stats, sizeof(*stats)); + spin_unlock_irqrestore(&tsk->sighand->siglock, flags); stats->version = TASKSTATS_VERSION; send: -- 2.47.3