lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 14 Mar 2017 16:46:34 +0100 From: Peter Zijlstra <peterz@...radead.org> To: Oleg Nesterov <oleg@...hat.com> Cc: Dmitry Vyukov <dvyukov@...gle.com>, Ingo Molnar <mingo@...hat.com>, Arnaldo Carvalho de Melo <acme@...nel.org>, Alexander Shishkin <alexander.shishkin@...ux.intel.com>, LKML <linux-kernel@...r.kernel.org>, Mathieu Desnoyers <mathieu.desnoyers@...icios.com>, syzkaller <syzkaller@...glegroups.com> Subject: Re: perf: use-after-free in perf_release On Tue, Mar 14, 2017 at 04:37:05PM +0100, Oleg Nesterov wrote: > On 03/14, Peter Zijlstra wrote: > > > > Do we want a WARN_ON_ONCE(atomic_read(&tsk->usage)); in free_task()? > > Because in the above scenario we're freeing it with references on. > > Not sure, in this case copy_process() should decrement tsk->usage > before free_task(), note the atomic_set(&tsk->usage, 2) in > dup_task_struct(). > > Perhaps we should just add WARN_ON(tsk->usage != 2) into copy_process() > right before free_task() ? Sure; that works. I'll try that once I'm back home again, to see if there's unexpected fail because other things increment it.
Powered by blists - more mailing lists