linux-kernel - Re: [PATCH] sched/numa: Fix use-after-free bug in the task_numa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <569CF0A7.4000306@redhat.com>
Date:	Mon, 18 Jan 2016 09:03:19 -0500
From:	Rik van Riel <riel@...hat.com>
To:	gavin.guo@...onical.com, linux-kernel@...r.kernel.org
Cc:	linux-mm@...ck.org, jay.vosburgh@...onical.com,
	liang.chen@...onical.com, mgorman@...e.de, mingo@...hat.com,
	peterz@...radead.org
Subject: Re: [PATCH] sched/numa: Fix use-after-free bug in the
 task_numa_compare

On 01/18/2016 08:59 AM, gavin.guo@...onical.com wrote:
> From: Gavin Guo <gavin.guo@...onical.com>

> As commit 1effd9f19324 ("sched/numa: Fix unsafe get_task_struct() in
> task_numa_assign()") points out, the rcu_read_lock() cannot protect the
> task_struct from being freed in the finish_task_switch(). And the bug
> happens in the process of calculation of imp which requires the access of
> p->numa_faults being freed in the following path:
> 
> do_exit()
>         current->flags |= PF_EXITING;
>     release_task()
>         ~~delayed_put_task_struct()~~
>     schedule()
>     ...
>     ...
> rq->curr = next;
>     context_switch()
>         finish_task_switch()
>             put_task_struct()
>                 __put_task_struct()
> 		    task_numa_free()
> 
> The fix here to get_task_struct() early before end of dst_rq->lock to
> protect the calculation process and also put_task_struct() in the
> corresponding point if finally the dst_rq->curr somehow cannot be
> assigned.
> 
> BugLink: https://bugs.launchpad.net/bugs/1527643
> Signed-off-by: Gavin Guo <gavin.guo@...onical.com>
> Signed-off-by: Liang Chen <liangchen.linux@...il.com>

Reviewed-by: Rik van Riel <riel@...hat.com>

-- 
All rights reversed