Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1377488

Re: Possible race in copy of fpu->state in copy_process against the exeve'ing parent?

From Jianyu Zhan <nasa4836@gmail.com>
Newsgroups linux.kernel
Subject Re: Possible race in copy of fpu->state in copy_process against the exeve'ing parent?
Date 2016-04-13 05:30 +0200
Message-ID <rnjF8-2ok-5@gated-at.bofh.it> (permalink)
References <rnjvr-2gl-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Wed, Apr 13, 2016 at 11:11 AM, Jianyu Zhan <nasa4836@gmail.com> wrote:
>
> So  I suspect there is a possible race:
>
>
>    Parent:
>
>        sys_execve
>          do_execve
>            do_execve_common
>              search_binary_handler
>                 load_elf_binary
>                   start_thread
>                     start_thread_common
>                        free_thread_xstate(current)
>                          fpu_free
>                             fpu->state = NULL
>
>
>     Child:
>
>         sys_clone
>           do_fork
>              copy_process
>                 dup_task_struct
>                    prepare_to_copy
>                       unlazy_fpu
>                          __save_init_fpu
>                            fpu_save_init
>                              fpu_xsave(fpu)   <---- fpu->sate is NULL,
> so cause a
>                                                                 NULL
> dereference.
>

Hmm,  I am wrong, it is not Parent vs Child.

It is :   Parent  executes  sys_execuve,  and then right after that,
executes sys_clone.


 Regards,
 Jianyu Zhan

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Possible race in copy of fpu->state in copy_process against the  exeve'ing parent? Jianyu Zhan <nasa4836@gmail.com> - 2016-04-13 05:20 +0200
  Re: Possible race in copy of fpu->state in copy_process against the  exeve'ing parent? Jianyu Zhan <nasa4836@gmail.com> - 2016-04-13 05:30 +0200
  Re: Possible race in copy of fpu->state in copy_process against the  exeve'ing parent? Ingo Molnar <mingo@kernel.org> - 2016-04-13 08:20 +0200
    Re: Possible race in copy of fpu->state in copy_process against the  exeve'ing parent? Jianyu Zhan <nasa4836@gmail.com> - 2016-04-13 09:30 +0200
      Re: Possible race in copy of fpu->state in copy_process against  the exeve'ing parent? Oleg Nesterov <oleg@redhat.com> - 2016-04-13 13:30 +0200

csiph-web