From nobody Thu Apr 2 18:59:40 2026 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B0D835E55B for ; Thu, 12 Feb 2026 22:12:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770934341; cv=none; b=gL9hyJNKTWCNRgYEOsD1zgSYi0koLS+quVy5Qex1rmN/uZQ4Kb2RMkdB4PfOPF699P8NLuUwM9YVi6lRNGN+qCwuIzlK0NEhjtowU4v1bUr0X56iZww5XF7uuyzdK0NiJPMnLt5mGGBF6dsKPsavwqHFGXld9GD32Bjyiq8CpDQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770934341; c=relaxed/simple; bh=WLZFrFNJUZZbzdI3MvDzzs0Zz5CI6Ca3g0rhOXh5p+8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mdQCaVoKBrZCr+ZqRmiOVOcktUiEOFa2xIyqHw1BrmFvB1h3r0Lfb2fMqmL34GLpgqbu2w4i4QP4qsre0nDKiPWtoXIa/A+dVMNWPLopu2+sF4XkQn6g+aDDaemP8HLtl6XEttiYKTOsDRed/cigylwx/02bkjUubVm41npenO4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=UM/L+H+Y; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="UM/L+H+Y" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-48371d2f661so5705e9.1 for ; Thu, 12 Feb 2026 14:12:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1770934338; x=1771539138; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=Xq8Akz2Pc6zq198eJ9mNj+KA928E8lN2gMAzGlMh/yM=; b=UM/L+H+Y0dj1569uRHlGkuZGhmgDScM9486EZ52mVOaWAS0wWoHb5H3H78AgXYnhDZ KTQAszVGvYfaIda3h5IvUliR3E5hJPXpbSn6X0a3INxM4+nDzk4yEgenU1Uh4DShPu6u 4GbfTDBoyrw/nq8GGgPoXoQEVLP40Nh8bmmUgeNy4KRZ87L5+tMXd3kKA+ja3XXh1dxY fwKb6H4SY9xABK+fc/6FzKMFPz0QzrqVKw2UmcjQhppfRqQ9f0UQtXwJ9OItnZ8eeAii E96vgZ9bCrF7xYzeU/elNdWq2eZcpeQdGr80A/TTxEbhkBDUcNiYx0dqp1NZrUAlK2ob LqaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770934338; x=1771539138; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=Xq8Akz2Pc6zq198eJ9mNj+KA928E8lN2gMAzGlMh/yM=; b=bEvDxA80UR+BFTX53NIxja/5y9MH5jQxryGP1s9tToHSdLzcZzY43GeGfITE/zhOcD vTE8MJqntZvPPa665doE5bfb2ruwZxhA5ms5LX3RCWBxgxXD6oohwNFkAlbfGizuDU5e CHPOElWujuVWltnSovNpOwaeu59n6M6r7h+WaJw70eKE/f1I3bph65QLtUXmO1XIBazH WIfzLGh7ErG18TSSu8153wTFC3v4BYu8hPl/X1BazDFv1V+9MJXQKU8UbXzfuIzSX8Go vrp345Ccd1Vwje5KFReWPWBMCBKbsLfMKuccjex9JDEViovQPfAGRdS6E+6GZGP3Pi/n oWuw== X-Forwarded-Encrypted: i=1; AJvYcCX6u45XeYNo+k2QOPR9wITNuI0uT+fnCFD68aD5tPdbCkMBL82Fuk4NAbIJihFbYqJBLuYHbMMnucxcdwU=@vger.kernel.org X-Gm-Message-State: AOJu0Yx02878GCBqWERjuNoWuH6tqFdX1YOKv1OALdOqN54Gwi17j2Ly u4EPEJ3amj56UMbxQNOiAhqDngOHFGw9kYsrwa/q2pPDpAdXcPkWM+JSDliIdHZ1hg== X-Gm-Gg: AZuq6aIAU0vBRdUd9XwbVdq4idKkehwCEDFdqZvNNCzpCEjZ1Bi8JOuDn18vvTjjy/i N1Qm3OYJoZo9jtNySUrk7Llkuma5ssj+jWzMzloLOzRheDHpUi6lxd+FS4jDgrTyzIDUgAuYVzA 4k/6tOq2IOKI0ccTdIlZBF7OkjrgFfB+TPgVDOYDUEwsS/d+hXcF5tamuJH34eZZqpKCSAbOkEQ uC3EiwUg8mUU0XGxCsUl/QtAAYm9XuHW0kT0i5JgvMgF36VptqPOVmNjiNdINI9MUh11He0qWMj JjSFuYeOjXWTQIIpRiXA0ktPJvbhmZKloK6C0xmiqzN1fUB1s7ySedtqin4og7erkcNuTgOpBpR OgtrB/Ta1NbqPR+VrPGzhZqQocb7cLrjtATCgAFP7nexxZTd6ctC1YetNHwuqTZESJJSdZDv81H Aw9Gp3xkylQJKRoqq7NwZSlcGm+uUEO/pKKLPBzjS0mHApFFvSZSscA3f+j8mSvA== X-Received: by 2002:a05:600c:a59c:b0:47d:7304:d759 with SMTP id 5b1f17b1804b1-48371cd4901mr24245e9.15.1770934337474; Thu, 12 Feb 2026 14:12:17 -0800 (PST) Received: from localhost ([2a00:79e0:288a:8:c531:3fec:ad3b:1a8d]) by smtp.gmail.com with UTF8SMTPSA id ffacd0b85a97d-43796a5acaasm903029f8f.6.2026.02.12.14.12.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Feb 2026 14:12:16 -0800 (PST) From: Jann Horn Date: Thu, 12 Feb 2026 23:12:06 +0100 Subject: [PATCH v2 1/2] rust: task: limit group_leader() to current Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260212-rust-de_thread-v2-1-7d274c4fd02e@google.com> References: <20260212-rust-de_thread-v2-0-7d274c4fd02e@google.com> In-Reply-To: <20260212-rust-de_thread-v2-0-7d274c4fd02e@google.com> To: Miguel Ojeda , Boqun Feng , Gary Guo , =?utf-8?q?Bj=C3=B6rn_Roy_Baron?= , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich Cc: Wedson Almeida Filho , Martin Rodriguez Reboredo , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Jann Horn X-Mailer: b4 0.15-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1770934330; l=3390; i=jannh@google.com; s=20240730; h=from:subject:message-id; bh=WLZFrFNJUZZbzdI3MvDzzs0Zz5CI6Ca3g0rhOXh5p+8=; b=7+Y0mIogC+d0XpSQoKvJFg+oEOYeZLmZghkPOS/M3DTG1DGeic1rkKymaB2aA14mlBBXgT71W lxuWFaFNKBHARoKuChKuzqhSNg7FruPVrHJ3aYJBGDDFgsSfyHZ2c2y X-Developer-Key: i=jannh@google.com; a=ed25519; pk=AljNtGOzXeF6khBXDJVVvwSEkVDGnnZZYqfWhP1V+C8= (Note: This is not a bugfix, it just cleans up an incorrect assumption.) Task::group_leader() assumes that task::group_leader remains constant until the task refcount drops to zero. However, Linux has a special quirk where, when execve() is called by a thread other than the thread group leader (the main thread), de_thread() swaps the current thread's identity with the thread group leader's, making the current thread the new thread group leader. This means task::group_leader can't be assumed to be immutable for non-current tasks. For reference, you can see that accessing the ->group_leader of some random task requires extra caution in the prlimit64() syscall, which grabs the tasklist_lock and has a comment explaining that this is done to prevent races with de_thread(). Signed-off-by: Jann Horn --- rust/kernel/task.rs | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs index 49fad6de0674..91ad88cdfd3b 100644 --- a/rust/kernel/task.rs +++ b/rust/kernel/task.rs @@ -103,7 +103,7 @@ macro_rules! current { unsafe impl Send for Task {} =20 // SAFETY: It's OK to access `Task` through shared references from other t= hreads because we're -// either accessing properties that don't change (e.g., `pid`, `group_lead= er`) or that are properly +// either accessing properties that don't change or that are properly // synchronised by C code (e.g., `signal_pending`). unsafe impl Sync for Task {} =20 @@ -204,18 +204,6 @@ pub fn as_ptr(&self) -> *mut bindings::task_struct { self.0.get() } =20 - /// Returns the group leader of the given task. - pub fn group_leader(&self) -> &Task { - // SAFETY: The group leader of a task never changes after initiali= zation, so reading this - // field is not a data race. - let ptr =3D unsafe { *ptr::addr_of!((*self.as_ptr()).group_leader)= }; - - // SAFETY: The lifetime of the returned task reference is tied to = the lifetime of `self`, - // and given that a task has a reference to its group leader, we k= now it must be valid for - // the lifetime of the returned task reference. - unsafe { &*ptr.cast() } - } - /// Returns the PID of the given task. pub fn pid(&self) -> Pid { // SAFETY: The pid of a task never changes after initialization, s= o reading this field is @@ -345,6 +333,18 @@ pub fn active_pid_ns(&self) -> Option<&PidNamespace> { // `release_task()` call. Some(unsafe { PidNamespace::from_ptr(active_ns) }) } + + /// Returns the group leader of the current task. + pub fn group_leader(&self) -> &Task { + // SAFETY: The group leader of the current task never changes in s= yscall + // context (except in the implementation of execve()). + let ptr =3D unsafe { *ptr::addr_of!((*self.as_ptr()).group_leader)= }; + + // SAFETY: The lifetime of the returned task reference is tied to = the lifetime of `self`, + // and given that a task has a reference to its group leader, we k= now it must be valid for + // the lifetime of the returned task reference. + unsafe { &*ptr.cast() } + } } =20 // SAFETY: The type invariants guarantee that `Task` is always refcounted. --=20 2.53.0.273.g2a3d683680-goog From nobody Thu Apr 2 18:59:40 2026 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D0C8435EDB9 for ; Thu, 12 Feb 2026 22:12:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770934343; cv=none; b=ky9P7sgL8bO+q3d9ht1rWi/UfVystZlpaAV5cf/pG7QRrBdD3isbN3YuUknowqVehMlhpohoKQHvTGbv1f9tWpWfqGa+9M3k+ckQMhx9njv1njYgmNgAuyLloUFeILhBcKDPkET435iMySDeFKNwkv4TO+/wWdh713VnwqzN548= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770934343; c=relaxed/simple; bh=7V2N6dp2rjo7koplHKhlgc4XVo2ZSpj3B/T/irCiBIU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OeYszNWznafZuH/oBhOyC85lLozlkb6ylG3poX3a27V51j7ORYxxL2jdLEZeH+bZG+QsyOpfzYSf7wBaxPpcrmQaAkSSs1V9i8NY/nxl4TvmnuI2SUmjY0azJVnETOHps5pcnNYc394881WarJzXhu9CXl3K2w5rQr0JG7GHeUo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=KJcVylDS; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="KJcVylDS" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-48371d2f661so5885e9.1 for ; Thu, 12 Feb 2026 14:12:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1770934340; x=1771539140; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=Fe2Y/SZJ5x/5lMCQoOZFFno/AsLWveHnxx6IJQErxeI=; b=KJcVylDSySiSj65nW6r98Ss8e+Jv3XVnwiLIiAb23HIiw8HFl7ARKD1MqWi1ELrRUz xBzPpNv66mAAYlPo9GrZz/DpunEkOtrV5iANTx+AN8XmpTk6ye0npWAumRhMr9HPtq3U InYnZoP4KjAe0lVIcsXwjodq76tbkB9Nf1iCI4WZkPPbCwRoD2Iq3APp/1fifAPwC0Uw zaibWO5GzqrbNzEjqrT7ALS2X3iVZveTk9fURqXdTQo26n1c2TcRBOy2MLCtfXrKzK0e hGKwbuEChMyQEqzI6v9BfdGZk96WvyaYRSwiztdcwubyA7loj4jdb53ZBz3xuVlM5Dij 9Ylw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770934340; x=1771539140; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=Fe2Y/SZJ5x/5lMCQoOZFFno/AsLWveHnxx6IJQErxeI=; b=fmDB0Fkf40nc1Cpj/gdX9MfXtgh3ZrurpYXEI+po4uqBfGnWe88WJ5pEtLSRBvL85f XaR+WHglFCc7XmbkwANl6oaJ5xHZ+c56f1Vd28DhrCblgrYpnpYLdviz2PqlYoZXlMjV PpwiGqxH7lnKEivqoFc1aNf2M4n/mbmmd59Wd6GGf5nLCeJSCci/Lp68vrIhs+1o76Jz GHr7KNwIfcnUIGgq1dzaMtAGclt0jtULHiIRwgVnnTfxtq3/QA6LvgNFrgGIHj30l1O1 7jEY+Ct1seOiysqXn/SpDoFNfFmnZIUV3/MblC0mj3pErQBkzoSpAu2UBow473IM8MKl diuA== X-Forwarded-Encrypted: i=1; AJvYcCVLLP85w+q3/a6vjnt5A7/KxSXsPkVhpo4LpisywbXX9zdJ8d3K1OdeLIj8oSbsRieCCdz+kHJ3tCBBD9Q=@vger.kernel.org X-Gm-Message-State: AOJu0YyC7/qJ0+kftyC5khqyBPsaJn84U0yB9Kt+115Yz9s1L9G4zzP8 UrSmL1BhnReGSJUIBJ8/vIX3O7dbAX+vvCokq6k9mb+cQ4suGOFjvaetubX1rZz5bw== X-Gm-Gg: AZuq6aKwsQl6B17+Hfm+CTHw3A6FSn+DrioRaNT+JvfCba7JgoBbxha6jEcmMiPsdBi hx8NGB3A8bZH7dA4rC83cYdDMoFoIkfbxPiMqrbwCipHqQADqTyywSw117XRmv+ijOWnMm+vfCk sKmi+bDxwInJpFq23JBFpb2PspSKqnOTzzE05uVqeiNHAE33HS+RHarj5BfWOzM9ahz/bgdyz4P O1z40zwZXKMX+1Yh6jXV4Tpngn2bdmAHTFXE1K6Cu3Qyb7nnZzWObphmFwcV9KDmo7JXzP9kPsQ g12JZrIhKokk41N+PyJ9YlNyKxlaG81LmH3GlJWCXZfJ2XXf/mILDs/9ixOoXmoOA0/JntEmrj+ HqPuWXoCNV9ds/wHCBExfXB3zJ0ZZb9SOcHjqn72GS0Rx76Ecwjad4xwpQ4341g2z6Z+pWnPatA XiJRx1BtP9YX7rzqZyLUG3ZwHvXg0COVdiLvLaTelNHqdEzvvFEP0= X-Received: by 2002:a05:600c:3b8b:b0:477:95a8:2562 with SMTP id 5b1f17b1804b1-48371cd4764mr77525e9.13.1770934339797; Thu, 12 Feb 2026 14:12:19 -0800 (PST) Received: from localhost ([2a00:79e0:288a:8:c531:3fec:ad3b:1a8d]) by smtp.gmail.com with UTF8SMTPSA id ffacd0b85a97d-43796abc85csm773992f8f.22.2026.02.12.14.12.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Feb 2026 14:12:18 -0800 (PST) From: Jann Horn Date: Thu, 12 Feb 2026 23:12:07 +0100 Subject: [PATCH v2 2/2] rust: task: use atomic read for pid() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260212-rust-de_thread-v2-2-7d274c4fd02e@google.com> References: <20260212-rust-de_thread-v2-0-7d274c4fd02e@google.com> In-Reply-To: <20260212-rust-de_thread-v2-0-7d274c4fd02e@google.com> To: Miguel Ojeda , Boqun Feng , Gary Guo , =?utf-8?q?Bj=C3=B6rn_Roy_Baron?= , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich Cc: Wedson Almeida Filho , Martin Rodriguez Reboredo , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Jann Horn X-Mailer: b4 0.15-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1770934330; l=1995; i=jannh@google.com; s=20240730; h=from:subject:message-id; bh=7V2N6dp2rjo7koplHKhlgc4XVo2ZSpj3B/T/irCiBIU=; b=4fc49eYXZWYTuHDde4f87z/If6iB+RrHcXKLQz6Nn0RyvL4RVi6DcHMdRnlpDHtC5kby6UFDU LkUtCBYobLwB0b8lyDokLxInpJtyEI+di+sWngPIGzxkb7z2JltPgIC X-Developer-Key: i=jannh@google.com; a=ed25519; pk=AljNtGOzXeF6khBXDJVVvwSEkVDGnnZZYqfWhP1V+C8= (Note: This is not a bugfix, it just cleans up an incorrect assumption.) Task::pid() wrongly assumes that task::pid remains constant until the task refcount drops to zero. However, Linux has a special quirk where, when execve() is called by a thread other than the thread group leader (the main thread), the thread calling execve() swaps its identity with the thread group leader's, becoming the new thread group leader. This means task::pid can't be assumed to be immutable for non-current tasks. (The actual swapping of PIDs is implemented in exchange_tids().) Signed-off-by: Jann Horn Reviewed-by: Alice Ryhl Reviewed-by: Boqun Feng --- rust/kernel/task.rs | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs index 91ad88cdfd3b..de0d90b47862 100644 --- a/rust/kernel/task.rs +++ b/rust/kernel/task.rs @@ -10,6 +10,8 @@ mm::MmWithUser, pid_namespace::PidNamespace, sync::aref::ARef, + sync::atomic::ordering::Relaxed, + sync::atomic::Atomic, types::{NotThreadSafe, Opaque}, }; use core::{ @@ -206,9 +208,13 @@ pub fn as_ptr(&self) -> *mut bindings::task_struct { =20 /// Returns the PID of the given task. pub fn pid(&self) -> Pid { - // SAFETY: The pid of a task never changes after initialization, s= o reading this field is - // not a data race. - unsafe { *ptr::addr_of!((*self.as_ptr()).pid) } + // SAFETY: The pid of a task almost never changes after initializa= tion, + // so reading this field is usually not a data race. + // The exception is a race where the task is part of a process that + // goes through execve(), see exchange_tids(). + // A temporary mutable pointer is created, but only actually used = for + // a load. + unsafe { Atomic::from_ptr(&raw mut (*self.as_ptr()).pid).load(Rela= xed) } } =20 /// Returns the UID of the given task. --=20 2.53.0.273.g2a3d683680-goog