Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1311692

Re: [PATCH V2] sched/numa: Fix use-after-free bug in the task_numa_compare

Show all headers | View raw

On Mon, Jan 18, 2016 at 11:24:21PM +0800, gavin.guo@canonical.com wrote:
> From: Gavin Guo <gavin.guo@canonical.com>
> 
> The following message can be observed on the Ubuntu v3.13.0-65 with KASan
> backported:

<snip>

> As commit 1effd9f19324 ("sched/numa: Fix unsafe get_task_struct() in
> task_numa_assign()") points out, the rcu_read_lock() cannot protect the
> task_struct from being freed in the finish_task_switch(). And the bug
> happens in the process of calculation of imp which requires the access of
> p->numa_faults being freed in the following path:
> 
> do_exit()
>         current->flags |= PF_EXITING;
>     release_task()
>         ~~delayed_put_task_struct()~~
>     schedule()
>     ...
>     ...
> rq->curr = next;
>     context_switch()
>         finish_task_switch()
>             put_task_struct()
>                 __put_task_struct()
> 		    task_numa_free()
> 
> The fix here to get_task_struct() early before end of dst_rq->lock to
> protect the calculation process and also put_task_struct() in the
> corresponding point if finally the dst_rq->curr somehow cannot be
> assigned.
> 
> v1->v2:
> - Fix coding style suggested by Peter Zijlstra.
> 
> Signed-off-by: Gavin Guo <gavin.guo@canonical.com>
> Signed-off-by: Liang Chen <liangchen.linux@gmail.com>

Argh, sorry for not noticing before; this SoB chain is not valid.

Gavin wrote (per From) and send me the patch (per actual email headers),
so Liang never touched it.

Should that be a reviewed-by for him?

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] sched/numa: Fix use-after-free bug in the task_numa_compare gavin.guo@canonical.com - 2016-01-18 15:00 +0100
  Re: [PATCH] sched/numa: Fix use-after-free bug in the  task_numa_compare Rik van Riel <riel@redhat.com> - 2016-01-18 15:10 +0100
  Re: [PATCH] sched/numa: Fix use-after-free bug in the  task_numa_compare Peter Zijlstra <peterz@infradead.org> - 2016-01-18 15:40 +0100
    [PATCH V2] sched/numa: Fix use-after-free bug in the task_numa_compare gavin.guo@canonical.com - 2016-01-18 16:30 +0100
      Re: [PATCH V2] sched/numa: Fix use-after-free bug in the  task_numa_compare Peter Zijlstra <peterz@infradead.org> - 2016-01-18 18:20 +0100
        Re: [PATCH V2] sched/numa: Fix use-after-free bug in the task_numa_compare Gavin Guo <gavin.guo@canonical.com> - 2016-01-19 00:50 +0100
          Re: [PATCH V2] sched/numa: Fix use-after-free bug in the  task_numa_compare Ingo Molnar <mingo@kernel.org> - 2016-01-19 10:40 +0100
            [PATCH V3] sched/numa: Fix use-after-free bug in the task_numa_compare gavin.guo@canonical.com - 2016-01-20 05:40 +0100
              [tip:sched/urgent] sched/numa:   Fix use-after-free bug in the task_numa_compare tip-bot for Gavin Guo <tipbot@zytor.com> - 2016-01-21 20:00 +0100
              [tip:sched/urgent] sched/numa:   Fix use-after-free bug in the task_numa_compare tip-bot for Gavin Guo <tipbot@zytor.com> - 2016-01-22 14:00 +0100

csiph-web