Page MenuHomeFreeBSD

kthread: Set *newtdb earlier in kthread_add1()
ClosedPublic

Authored by markj on Dec 9 2023, 3:31 PM.
Tags
None
Referenced Files
F172522330: D42986.id131223.diff
Sat, Sep 19, 12:49 AM
F172522297: D42986.id131219.diff
Sat, Sep 19, 12:49 AM
F172520769: D42986.diff
Sat, Sep 19, 12:33 AM
Unknown Object (File)
Sun, Sep 13, 1:18 PM
Unknown Object (File)
Sun, Aug 30, 8:36 AM
Unknown Object (File)
Sat, Aug 29, 9:00 AM
Unknown Object (File)
Sun, Aug 23, 8:54 PM
Unknown Object (File)
Fri, Aug 21, 3:21 PM
Subscribers

Details

Summary

syzbot reported a boot-time crash in g_event_procbody(), a page fault
when dereferencing g_event_td. g_event_td is initialized by the
kproc_kthread_add() call which creates the GEOM event thread:

kproc_kthread_add(g_event_procbody, NULL, &g_proc, &g_event_td,
    RFHIGHPID, 0, "geom", "g_event");

The crash happened just once; I suspect that the caller of
kproc_kthread_add() was preempted after adding the new thread to the
scheduler, and before setting *newtdp, which is equal to g_event_td.

Fix the problem simply by initializing *newtdp earlier. I see no harm
in that, and it matches kproc_create1(). The scheduler provides
sufficient synchronization to ensure that the store is visible to the
new thread, wherever it happens to run.

MFC after: 1 week
Reported by: syzbot+5397f4d39219b85a9409@syzkaller.appspotmail.com

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable