diff options
| author | Guopeng Zhang <zhangguopeng@kylinos.cn> | 2026-06-25 09:39:44 +0800 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2026-06-25 11:12:19 -1000 |
| commit | da43ea213936494732e52212c59f027967b97173 (patch) | |
| tree | 6c2527f0e066266253642f13d90d251b3d6885a7 /include | |
| parent | 8a564dfdfd88f1c5262ad1a4957310fe907650fc (diff) | |
| download | linux-da43ea213936494732e52212c59f027967b97173.tar.gz linux-da43ea213936494732e52212c59f027967b97173.zip | |
cgroup: Use data_race() for task->flags in task_css_set_check()
task_css_set_check() uses rcu_dereference_check() to verify that
task->cgroups can be dereferenced. One accepted condition is that the
task is already exiting, tested by checking PF_EXITING in task->flags.
This check is only part of the CONFIG_PROVE_RCU lockdep predicate. This
was found by KCSAN during fuzz testing. KCSAN can report a data race
when another task flag bit is updated concurrently. One report shows
pids_release() reading task->flags through task_css_set_check() while
do_task_dead() sets PF_NOFREEZE:
KCSAN: data-race in task_css() [inline]
KCSAN: data-race in pids_release()
task_css()
pids_release()
cgroup_release()
release_task()
wait_task_zombie()
value changed: 0x0040004c -> 0x0040804c
The changed bit is PF_NOFREEZE, not PF_EXITING. PF_EXITING remains set
before and after the update, so the task_css_set_check() condition does
not change. This is not a race on task->cgroups and does not indicate
incorrect pids charging or uncharging.
tools/memory-model/Documentation/access-marking.txt recommends
data_race() for data-racy loads used only for diagnostic purposes. Use
data_race() here to mark the intended diagnostic-only access.
No functional change intended.
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/cgroup.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index f2aa46a4f871..b905208942bf 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -480,7 +480,7 @@ static inline void cgroup_unlock(void) rcu_read_lock_sched_held() || \ lockdep_is_held(&cgroup_mutex) || \ lockdep_is_held(&css_set_lock) || \ - ((task)->flags & PF_EXITING) || (__c)) + (data_race((task)->flags) & PF_EXITING) || (__c)) #else #define task_css_set_check(task, __c) \ rcu_dereference((task)->cgroups) |