Messages in this thread | | | Date | Mon, 18 Jan 2016 18:13:28 +0100 | From | Peter Zijlstra <> | Subject | Re: [PATCH V2] sched/numa: Fix use-after-free bug in the task_numa_compare |
| |
On Mon, Jan 18, 2016 at 11:24:21PM +0800, gavin.guo@canonical.com wrote: > From: Gavin Guo <gavin.guo@canonical.com> > > The following message can be observed on the Ubuntu v3.13.0-65 with KASan > backported:
<snip>
> As commit 1effd9f19324 ("sched/numa: Fix unsafe get_task_struct() in > task_numa_assign()") points out, the rcu_read_lock() cannot protect the > task_struct from being freed in the finish_task_switch(). And the bug > happens in the process of calculation of imp which requires the access of > p->numa_faults being freed in the following path: > > do_exit() > current->flags |= PF_EXITING; > release_task() > ~~delayed_put_task_struct()~~ > schedule() > ... > ... > rq->curr = next; > context_switch() > finish_task_switch() > put_task_struct() > __put_task_struct() > task_numa_free() > > The fix here to get_task_struct() early before end of dst_rq->lock to > protect the calculation process and also put_task_struct() in the > corresponding point if finally the dst_rq->curr somehow cannot be > assigned. > > v1->v2: > - Fix coding style suggested by Peter Zijlstra. > > Signed-off-by: Gavin Guo <gavin.guo@canonical.com> > Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
Argh, sorry for not noticing before; this SoB chain is not valid.
Gavin wrote (per From) and send me the patch (per actual email headers), so Liang never touched it.
Should that be a reviewed-by for him?
| |