linux-kernel - Re: [PATCH] sched/numa: Fix use-after-free bug in the task_numa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 18 Jan 2016 15:33:45 +0100
From:	Peter Zijlstra <peterz@...radead.org>
To:	gavin.guo@...onical.com
Cc:	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	jay.vosburgh@...onical.com, liang.chen@...onical.com,
	mgorman@...e.de, mingo@...hat.com, riel@...hat.com
Subject: Re: [PATCH] sched/numa: Fix use-after-free bug in the
 task_numa_compare

On Mon, Jan 18, 2016 at 09:59:08PM +0800, gavin.guo@...onical.com wrote:
> BugLink: https://bugs.launchpad.net/bugs/1527643

These do not go in patches..

>  	/*
> +	 * No need to move the exiting task or idle task.
>  	 */
>  	if ((cur->flags & PF_EXITING) || is_idle_task(cur))
>  		cur = NULL;
> +	else
> +		/*
> +		 * The task_struct must be protected here to protect the
> +		 * p->numa_faults access in the task_weight since the
> +		 * numa_faults could already be freed in the following path:
> +		 * finish_task_switch()
> +		 *     --> put_task_struct()
> +		 *         --> __put_task_struct()
> +		 *             --> task_numa_free()
> +		 */
> +		get_task_struct(cur);
> +

This is incorrect CodingStyle, please add { }.