Re: [PATCH] fix sighand use after free

[Rik van Riel <riel@redhat.com>]

On 08/13/2014 12:19 PM, Oleg Nesterov wrote:
> On 08/13, Rik van Riel wrote:
>>
>> On 08/13/2014 11:58 AM, Oleg Nesterov wrote:
>>> On 08/13, Rik van Riel wrote:
>>>>
>>>> @@ -1017,7 +1017,7 @@ void __cleanup_sighand(struct sighand_struct *sighand)
>>>>  {
>>>>  	if (atomic_dec_and_test(&sighand->count)) {
>>>>  		signalfd_cleanup(sighand);
>>>> -		kmem_cache_free(sighand_cachep, sighand);
>>>> +		rcu_free(sighand_cachep, sighand);
>>>
>>> Please note that sighand_cachep is SLAB_DESTROY_BY_RCU.
>>
>> SLAB_DESTROY_BY_RCU means that the slab page is not given
>> back to the system until after the RCU grace period has
>> expired.
>>
>> However, the objects inside the slab can still be reused
>> immediately!
> 
> Yes. This is fine. This memory won't be returned to system before rcu
> gp pass, and this memory is still "struct sighand_struct" with the
> properly initialized ->siglock (note the sighand_ctor()).

Fair enough, you are right.

The sighand_ctor does prevent any issues.

The slub code also prevents slubs with constructor
functions from ever getting merged, so this is all
taken care of.