Messages in this thread | | | Date | Fri, 5 May 2017 18:44:28 +0200 | From | Oleg Nesterov <> | Subject | Re: [PATCH] kthread: fix use-after-free if kthread fork fails |
| |
On 05/05, Vegard Nossum wrote: > > If a kthread forks (e.g. usermodehelper since commit 1da5c46fa965) but > fails in copy_process() between calling dup_task_struct() and setting > p->set_child_tid, then the value of p->set_child_tid will be inherited > from the parent and get prematurely freed by free_kthread_struct().
Aaah... thanks!
> --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -518,6 +518,13 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) > atomic_set(&tsk->stack_refcount, 1); > #endif > > + /* > + * Forking kthreads (e.g. usermodehelper) should not inherit this > + * field since it's a pointer to a 'struct kthread' which is not > + * reference counted. > + */ > + tsk->set_child_tid = NULL; > +
Can't we just move both
p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; /* * Clear TID on mm_release()? */ p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
lines here?
Oleg.
| |