lkml.org 
[lkml]   [2011]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] Re: [PATCH] sched, cgroup: Use exit hook to avoid use-after-free crash
From
Date
On Fri, 2010-12-31 at 09:32 +0100, Mike Galbraith wrote:

> sched: fix autogroup reference leak and cpu_cgroup_exit() explosion
>
> In the event of a fork failure, the new cpu_cgroup_exit() method tries to
> move an unhashed task. Since PF_EXITING isn't set in that case, autogroup
> will dig aground in a freed signal_struct. Neither cgroups nor autogroup
> has anything it needs to do with this shade, so don't go there.
>
> This also uncovered a struct autogroup reference leak. copy_process() was
> simply freeing vs putting the signal_struct, stranding a reference.
>
> Signed-off-by: Mike Galbraith <efault@gmx.de>
>
> ---
> kernel/fork.c | 2 +-
> kernel/sched.c | 10 ++++++++++
> 2 files changed, 11 insertions(+), 1 deletion(-)
>
> Index: linux-2.6.37.git/kernel/fork.c
> ===================================================================
> --- linux-2.6.37.git.orig/kernel/fork.c
> +++ linux-2.6.37.git/kernel/fork.c
> @@ -1318,7 +1318,7 @@ bad_fork_cleanup_mm:
> }
> bad_fork_cleanup_signal:
> if (!(clone_flags & CLONE_THREAD))
> - free_signal_struct(p->signal);
> + put_signal_struct(p->signal);
> bad_fork_cleanup_sighand:
> __cleanup_sighand(p->sighand);
> bad_fork_cleanup_fs:
> Index: linux-2.6.37.git/kernel/sched.c
> ===================================================================
> --- linux-2.6.37.git.orig/kernel/sched.c
> +++ linux-2.6.37.git/kernel/sched.c
> @@ -9193,6 +9193,16 @@ cpu_cgroup_attach(struct cgroup_subsys *
> static void
> cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task)
> {
> + /*
> + * cgroup_exit() is called in the copy_process failure path.
> + * The task isn't hashed, and we don't want to make autogroup
> + * dig into a freed signal_struct, so just go away.
> + *
> + * XXX: why are cgroup methods diddling unattached tasks?
> + */
> + if (!(task->flags & PF_EXITING))
> + return;
> +
> sched_move_task(task);
> }

Ah, that looks plausible. I've folded this chunk into my patch and kept
your fork-fail mod in a separate patch.


\
 
 \ /
  Last update: 2011-01-03 09:23    [W:0.073 / U:0.168 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site