lkml.org 
[lkml]   [2016]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] sched/numa: Fix use-after-free bug in the task_numa_compare
From
Date
On 01/18/2016 08:59 AM, gavin.guo@canonical.com wrote:
> From: Gavin Guo <gavin.guo@canonical.com>

> As commit 1effd9f19324 ("sched/numa: Fix unsafe get_task_struct() in
> task_numa_assign()") points out, the rcu_read_lock() cannot protect the
> task_struct from being freed in the finish_task_switch(). And the bug
> happens in the process of calculation of imp which requires the access of
> p->numa_faults being freed in the following path:
>
> do_exit()
> current->flags |= PF_EXITING;
> release_task()
> ~~delayed_put_task_struct()~~
> schedule()
> ...
> ...
> rq->curr = next;
> context_switch()
> finish_task_switch()
> put_task_struct()
> __put_task_struct()
> task_numa_free()
>
> The fix here to get_task_struct() early before end of dst_rq->lock to
> protect the calculation process and also put_task_struct() in the
> corresponding point if finally the dst_rq->curr somehow cannot be
> assigned.
>
> BugLink: https://bugs.launchpad.net/bugs/1527643
> Signed-off-by: Gavin Guo <gavin.guo@canonical.com>
> Signed-off-by: Liang Chen <liangchen.linux@gmail.com>

Reviewed-by: Rik van Riel <riel@redhat.com>

--
All rights reversed

\
 
 \ /
  Last update: 2016-01-18 15:21    [W:0.057 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site