On 8 October 2026 04:44:03 BST, Babanpreet Singh <[email protected]> wrote: >audit_ctl_owner_current() reads the lock owner without taking the lock >and KCSAN complains about it. Only the current task can store itself as >owner, so the check can't give a wrong answer. Mark the accesses with >READ_ONCE() and WRITE_ONCE(). > >Reported-by: [email protected] >Closes: https://syzkaller.appspot.com/bug?extid=39b8fea0641107a1ccee >Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Bradley Morgan <[email protected]> Tested-by: Bradley Morgan <[email protected]> # Power10 >Signed-off-by: Babanpreet Singh <[email protected]> >--- >v2: drop the comment in audit_ctl_owner_current(). The KCSAN build of >audit.o disassembles the same as v1. >v1: https://lore.kernel.org/all/[email protected]/ >Compile tested only (gcc W=1 and the KCSAN instrumentation diff); I >could not reproduce the race in QEMU. > > kernel/audit.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/kernel/audit.c b/kernel/audit.c >index 631d6d4a23cfd..d0c2036bde759 100644 >--- a/kernel/audit.c >+++ b/kernel/audit.c >@@ -247,7 +247,7 @@ int auditd_test_task(struct task_struct *task) > void audit_ctl_lock(void) > { > mutex_lock(&audit_cmd_mutex.lock); >- audit_cmd_mutex.owner = current; >+ WRITE_ONCE(audit_cmd_mutex.owner, current); > } > > /** >@@ -255,7 +255,7 @@ void audit_ctl_lock(void) > */ > void audit_ctl_unlock(void) > { >- audit_cmd_mutex.owner = NULL; >+ WRITE_ONCE(audit_cmd_mutex.owner, NULL); > mutex_unlock(&audit_cmd_mutex.lock); > } > >@@ -268,7 +268,7 @@ void audit_ctl_unlock(void) > */ > static bool audit_ctl_owner_current(void) > { >- return (current == audit_cmd_mutex.owner); >+ return (current == READ_ONCE(audit_cmd_mutex.owner)); > } > > /** Clean! > >base-commit: a8bdcf944504980635c2069b4a4cfcf677b09bbb > --- Thanks! "I'm not a very positive person" - Linus torvalds
