From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1756037AbcARRNf (ORCPT <rfc822;w@1wt.eu>);
	Mon, 18 Jan 2016 12:13:35 -0500
Received: from bombadil.infradead.org ([198.137.202.9]:38946 "EHLO
	bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1755894AbcARRNe (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Mon, 18 Jan 2016 12:13:34 -0500
Date: Mon, 18 Jan 2016 18:13:28 +0100
From: Peter Zijlstra <peterz@infradead.org>
To: gavin.guo@canonical.com
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        jay.vosburgh@canonical.com, liang.chen@canonical.com, mgorman@suse.de,
        mingo@redhat.com, riel@redhat.com
Subject: Re: [PATCH V2] sched/numa: Fix use-after-free bug in the
 task_numa_compare
Message-ID: <20160118171328.GT6357@twins.programming.kicks-ass.net>
References: <20160118143345.GQ6357@twins.programming.kicks-ass.net>
 <1453130661-16573-1-git-send-email-gavin.guo@canonical.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1453130661-16573-1-git-send-email-gavin.guo@canonical.com>
User-Agent: Mutt/1.5.21 (2012-12-30)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Jan 18, 2016 at 11:24:21PM +0800, gavin.guo@canonical.com wrote:
> From: Gavin Guo <gavin.guo@canonical.com>
> 
> The following message can be observed on the Ubuntu v3.13.0-65 with KASan
> backported:

<snip>

> As commit 1effd9f19324 ("sched/numa: Fix unsafe get_task_struct() in
> task_numa_assign()") points out, the rcu_read_lock() cannot protect the
> task_struct from being freed in the finish_task_switch(). And the bug
> happens in the process of calculation of imp which requires the access of
> p->numa_faults being freed in the following path:
> 
> do_exit()
>         current->flags |= PF_EXITING;
>     release_task()
>         ~~delayed_put_task_struct()~~
>     schedule()
>     ...
>     ...
> rq->curr = next;
>     context_switch()
>         finish_task_switch()
>             put_task_struct()
>                 __put_task_struct()
> 		    task_numa_free()
> 
> The fix here to get_task_struct() early before end of dst_rq->lock to
> protect the calculation process and also put_task_struct() in the
> corresponding point if finally the dst_rq->curr somehow cannot be
> assigned.
> 
> v1->v2:
> - Fix coding style suggested by Peter Zijlstra.
> 
> Signed-off-by: Gavin Guo <gavin.guo@canonical.com>
> Signed-off-by: Liang Chen <liangchen.linux@gmail.com>

Argh, sorry for not noticing before; this SoB chain is not valid.

Gavin wrote (per From) and send me the patch (per actual email headers),
so Liang never touched it.

Should that be a reviewed-by for him?