Messages in this thread | | | Date | Mon, 24 Oct 2016 14:22:10 +0200 | From | Peter Zijlstra <> | Subject | Re: hit a KASan bug related to Perf during stress test |
| |
On Mon, Oct 24, 2016 at 02:10:31PM +0200, Oleg Nesterov wrote: > --- x/kernel/pid.c > +++ x/kernel/pid.c > @@ -526,8 +526,11 @@ pid_t __task_pid_nr_ns(struct task_struc > if (!ns) > ns = task_active_pid_ns(current); > if (likely(pid_alive(task))) { > - if (type != PIDTYPE_PID) > + if (type != PIDTYPE_PID) { > + if (type == PIDTYPE_TGID) > + type = PIDTYPE_PID; > task = task->group_leader; > + }
Aah, that makes much more sense ;-)
> nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns); > } > rcu_read_unlock();
Still, I wonder if returning 0 is the right thing. 0 is a 'valid' PID for the init/idle task.
And we still have the re-use issue for the TID, because when we get here TID is already unhashed too afaict, it just doesn't explode because we don't deref freed memory.
| |