Re: [PATCH -next] fork: annotate a data race in vm_area_dup()

From: Qian Cai
Date: Tue Feb 18 2020 - 07:40:11 EST




> On Feb 18, 2020, at 5:29 AM, Kirill A. Shutemov <kirill@xxxxxxxxxxxxx> wrote:
>
> I think I've got this:
>
> vm_area_dup() blindly copies all fields of orignal VMA to the new one.
> This includes coping vm_area_struct::shared.rb which is normally protected
> by i_mmap_lock. But this is fine because the read value will be
> overwritten on the following __vma_link_file() under proper protectection.

Right, multiple processes could share the same file-based address space where those vma have been linked into address_space::i_mmap via vm_area_struct::shared.rb. Thus, the reader could see its shared.rb linkage pointers got updated by other processes.

>
> So the fix is correct, but justificaiton is lacking.
>
> Also, I would like to more fine-grained annotation: marking with
> data_race() 200 bytes copy may hide other issues.

That is the harder part where I donât think we have anything for that today. Macro, any suggestions? ASSERT_IGNORE_FIELD()?