linux-kernel - Re: [tip:perfcounters/core] perf_counter: Simplify and fix task migration counting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 19 Jun 2009 22:24:31 +1000
From:	Paul Mackerras <paulus@...ba.org>
To:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc:	mingo@...hat.com, hpa@...or.com, acme@...hat.com,
	linux-kernel@...r.kernel.org, efault@....de, mtosatti@...hat.com,
	tglx@...utronix.de, cjashfor@...ux.vnet.ibm.com, mingo@...e.hu,
	linux-tip-commits@...r.kernel.org
Subject: Re: [tip:perfcounters/core] perf_counter: Simplify and fix task
 migration counting

Peter Zijlstra writes:

> static struct perf_counter_context *perf_pin_task_context(struct task_struct *task)
> {
> 	struct perf_counter_context *ctx;
> 	unsigned long flags;
> 
> 	ctx = perf_lock_task_context(task, &flags);
> 	if (ctx) {
> 		++ctx->pin_count;
> 		get_ctx(ctx);
> 		spin_unlock_irqrestore(&ctx->lock, flags);
> 	}
> 	return ctx;
> }
> 
> Is buggy because perf_lock_task_context() can return a dead context.
> 
> the RCU read lock in perf_lock_task_context() only guarantees the memory
> won't get freed, it doesn't guarantee the object is valid (in our case
> refcount > 0).
> 
> Therefore we can return a locked object that can get freed the moment we
> release the rcu read lock.
> 
> perf_pin_task_context() then increases the refcount and does an unlock
> on freed memory.
> 
> That increased refcount will cause a double free, in case it started out
> with 0.

Wow, good catch!  Thanks for finding that.

Paul.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/