From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755251AbcARODZ (ORCPT ); Mon, 18 Jan 2016 09:03:25 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58303 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754972AbcARODW (ORCPT ); Mon, 18 Jan 2016 09:03:22 -0500 Subject: Re: [PATCH] sched/numa: Fix use-after-free bug in the task_numa_compare To: gavin.guo@canonical.com, linux-kernel@vger.kernel.org References: <1453125548-2762-1-git-send-email-gavin.guo@canonical.com> Cc: linux-mm@kvack.org, jay.vosburgh@canonical.com, liang.chen@canonical.com, mgorman@suse.de, mingo@redhat.com, peterz@infradead.org From: Rik van Riel Message-ID: <569CF0A7.4000306@redhat.com> Date: Mon, 18 Jan 2016 09:03:19 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <1453125548-2762-1-git-send-email-gavin.guo@canonical.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/18/2016 08:59 AM, gavin.guo@canonical.com wrote: > From: Gavin Guo > As commit 1effd9f19324 ("sched/numa: Fix unsafe get_task_struct() in > task_numa_assign()") points out, the rcu_read_lock() cannot protect the > task_struct from being freed in the finish_task_switch(). And the bug > happens in the process of calculation of imp which requires the access of > p->numa_faults being freed in the following path: > > do_exit() > current->flags |= PF_EXITING; > release_task() > ~~delayed_put_task_struct()~~ > schedule() > ... > ... > rq->curr = next; > context_switch() > finish_task_switch() > put_task_struct() > __put_task_struct() > task_numa_free() > > The fix here to get_task_struct() early before end of dst_rq->lock to > protect the calculation process and also put_task_struct() in the > corresponding point if finally the dst_rq->curr somehow cannot be > assigned. > > BugLink: https://bugs.launchpad.net/bugs/1527643 > Signed-off-by: Gavin Guo > Signed-off-by: Liang Chen Reviewed-by: Rik van Riel -- All rights reversed