linux-kernel - Re: [BUG] sched: leaf_cfs_rq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 11 Mar 2016 13:20:35 -0500
From:	Tejun Heo <tj@...nel.org>
To:	Peter Zijlstra <peterz@...radead.org>
Cc:	Niklas Cassel <niklas.cassel@...s.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] sched: leaf_cfs_rq_list use after free

Hello, Peter.

On Thu, Mar 10, 2016 at 01:54:17PM +0100, Peter Zijlstra wrote:
> > I've reproduced this on v4.4, but I've also managed to reproduce the bug
> > after cherry-picking the following patches
> > (all but one were marked for v4.4 stable):
> > 
> > 6fe1f34 sched/cgroup: Fix cgroup entity load tracking tear-down
> > d6e022f workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup
> > 041bd12 Revert "workqueue: make sure delayed work run in local cpu"
> > 8bb5ef7 cgroup: make sure a parent css isn't freed before its children
> > aa226ff cgroup: make sure a parent css isn't offlined before its children
> > e93ad19 cpuset: make mm migration asynchronous
> 
> Hmm, that is most unfortunate indeed.
> 
> Can you describe a reliable reproducer?
> 
> So we only call list_add_leaf_cfs_rq() through enqueue_task_fair(),
> which means someone is still running inside that cgroup.
> 
> TJ, I thought we only call offline when the cgroup is empty, don't we?

Yeap, populated csses shouldn't be being offlined.

Thanks.

-- 
tejun