[bug report] rcutorture: Add races with task-exit processing

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Paul E. McKenney,

The patch e02882cd57e3: "rcutorture: Add races with task-exit
processing" from Apr 24, 2020, leads to the following static checker
warning:

	kernel/rcu/rcutorture.c:2429 rcu_torture_read_exit()
	warn: 'rep' was already freed.

kernel/rcu/rcutorture.c
  2369  static int rcu_torture_read_exit(void *unused)
  2370  {
  2371          int count = 0;
  2372          bool errexit = false;
  2373          int i;
  2374          struct task_struct **rep;
  2375          struct torture_random_state *trsp;
  2376  
  2377          // Allocate and initialize.
  2378          set_user_nice(current, MAX_NICE);
  2379          rep = kcalloc(read_exit, sizeof(*rep), GFP_KERNEL);
  2380          trsp = kcalloc(read_exit, sizeof(*trsp), GFP_KERNEL);
  2381          if (rep && trsp) {
  2382                  for (i = 0; i < read_exit; i++)
  2383                          torture_random_init(&trsp[i]);
  2384                  VERBOSE_TOROUT_STRING("rcu_torture_read_exit: Start of test");
  2385          } else {
  2386                  kfree(rep);
                              ^^^
  2387                  kfree(trsp);
                              ^^^^
Freed.

  2388                  errexit = true;
  2389                  VERBOSE_TOROUT_ERRSTRING("out of memory");
  2390          }
  2391  
  2392          // Each pass through this loop does one read-exit episode.
  2393          while (!errexit && ! READ_ONCE(read_exit_child_stop)) {
  2394                  if (++count > read_exit_burst) {
  2395                          VERBOSE_TOROUT_STRING("rcu_torture_read_exit: End of episode");
  2396                          schedule_timeout_uninterruptible(HZ * read_exit_delay);
  2397                          VERBOSE_TOROUT_STRING("rcu_torture_read_exit: Start of episode");
  2398                          count = 0;
  2399                  }
  2400                  // Spawn children.
  2401                  for (i = 0; i < read_exit && i <= num_online_cpus(); i++) {
  2402                          // We don't want per-child console messages.
  2403                          rep[i] = kthread_run(rcu_torture_read_exit_child,
  2404                                               &trsp[i], "%s",
  2405                                               "rcu_torture_read_exit_child");
  2406                          if (IS_ERR(rep[i])) {
  2407                                  VERBOSE_TOROUT_ERRSTRING("out of memory");
  2408                                  errexit = true;
  2409                                  rep[i] = NULL;
  2410                                  break;
  2411                          }
  2412                          cond_resched();
  2413                  }
  2414                  n_read_exits += i;
  2415                  // Reap children.
  2416                  for (i--; i >= 0; i--) {
  2417                          kthread_stop(rep[i]);
  2418                          rep[i] = NULL;
  2419                          cond_resched();
  2420                  }
  2421                  rcu_barrier(); // Wait for task_struct freeing, avoid OOM.
  2422                  stutter_wait("rcu_torture_read_exit");
  2423          }
  2424  
  2425          // Clean up and exit.
  2426          smp_store_release(&read_exit_child_stopped, true); // After reaping.
  2427          smp_mb(); // Store before wakeup.
  2428          wake_up(&read_exit_wq);
  2429          kfree(rep);
                      ^^^
  2430          kfree(trsp);
                      ^^^^
Double freed.

  2431          while (!torture_must_stop())
  2432                  schedule_timeout_uninterruptible(1);
  2433          torture_kthread_stopping("rcu_torture_read_exit");
  2434          return 0;
  2435  }

regards,
dan carpenter