Messages in this thread |  | | Date | Mon, 9 Apr 2018 12:40:10 +0200 | From | Oleg Nesterov <> | Subject | Re: uprobes/perf: KASAN: use-after-free in uprobe_perf_close |
| |
On 04/09, Peter Zijlstra wrote: > > On Tue, Mar 06, 2018 at 06:49:10PM +0900, Prashant Bhole wrote: > > Sorry for late reply. I tried these changes. It didn't fix the problem. With > > He, sorry for completely forgetting about this one :/
me too, sorry Prashant,
> > these changes, the use-after-free access of task_struct occurs at > > _free_event() for the last remaining event.
Heh, I didn't even try to compile the "patch" I sent, I am not surprised it is not correct. But unless I forget again, I'll try to make the working version.
> > In your changes, I tried keeping get/put_task_struct() in > > perf_alloc_context()/put_ctx() intact and The problem did not occur. Change > > are mentioned below. > > Yes, I think you're right in that this is the cleanest solution; it add > reference counting to the exact pointer we're using.
OK, agreed, lets make the minimal fix for now.
But I still think that we should (try to) remove put_task_struct() from put_ctx().
Quite possibly I missed something, but I think it only adds some confusion. Once again, even if ctx can't go away you can't use ctx->task without TASK_TOMBSTONE check, exactly because this task can exit. So why perf_event_context should add another reference?
Oleg.
|  |