linux-kernel - Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260107094058.3753465-1-wangqing7171@gmail.com>
Date: Wed,  7 Jan 2026 17:40:58 +0800
From: Qing Wang <wangqing7171@...il.com>
To: oleg@...hat.com
Cc: thaumy.love@...il.com,
	Liam.Howlett@...cle.com,
	akpm@...ux-foundation.org,
	brauner@...nel.org,
	bsegall@...gle.com,
	jack@...e.cz,
	joel.granados@...nel.org,
	juri.lelli@...hat.com,
	linux-kernel@...r.kernel.org,
	lorenzo.stoakes@...cle.com,
	mingo@...hat.com,
	mjguzik@...il.com,
	peterz@...radead.org,
	rostedt@...dmis.org,
	rppt@...nel.org,
	syzbot+e0378d4f4fe57aa2bdd0@...kaller.appspotmail.com,
	wangqing7171@...il.com
Subject: Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr_ns

On Tue, 06 Jan 2026 at 20:50, Oleg Nesterov <oleg@...hat.com> wrote:
> On a second thought...
> 
> sched_fork() is called before perf_event_init_task(). So perhaps
> sync_child_event() could also check task->__state != TASK_NEW before
> perf_event_read_event() ?
> 
> Not sure, I know nothing about perf. Would be nice if perf experts can
> take a look.
> 
> Oleg.

I agree with your idea. But we don't need to fix this issue anymore,
because after reviewing the current mainline code, I found that it has
already been resolved(c418d8b4d7a4 "perf/core: Fix missing read event
generation on task exit") by moving sync_child_event() from
perf_child_detach() into perf_event_exit_event().

Here https://patch.msgid.link/20251209041600.963586-1-thaumy.love@gmail.com

As a result, perf_event_read_event() no longer occurs on the problematic
path reported (i.e., the close()->perf_release() path).

Qing.