Re: [PATCH] Re: [PATCH] sched, cgroup: Use exit hook to avoiduse-after-free crash

[Peter Zijlstra]

On Fri, 2010-12-31 at 09:32 +0100, Mike Galbraith wrote:

> sched: fix autogroup reference leak and cpu_cgroup_exit() explosion
> 
> In the event of a fork failure, the new cpu_cgroup_exit() method tries to
> move an unhashed task.  Since PF_EXITING isn't set in that case, autogroup
> will dig aground in a freed signal_struct.  Neither cgroups nor autogroup
> has anything it needs to do with this shade, so don't go there.
> 
> This also uncovered a struct autogroup reference leak. copy_process() was
> simply freeing vs putting the signal_struct, stranding a reference.
> 
> Signed-off-by: Mike Galbraith <efault@xxxxxx>
> 
> ---
>  kernel/fork.c  |    2 +-
>  kernel/sched.c |   10 ++++++++++
>  2 files changed, 11 insertions(+), 1 deletion(-)
> 
> Index: linux-2.6.37.git/kernel/fork.c
> ===================================================================
> --- linux-2.6.37.git.orig/kernel/fork.c
> +++ linux-2.6.37.git/kernel/fork.c
> @@ -1318,7 +1318,7 @@ bad_fork_cleanup_mm:
>  	}
>  bad_fork_cleanup_signal:
>  	if (!(clone_flags & CLONE_THREAD))
> -		free_signal_struct(p->signal);
> +		put_signal_struct(p->signal);
>  bad_fork_cleanup_sighand:
>  	__cleanup_sighand(p->sighand);
>  bad_fork_cleanup_fs:
> Index: linux-2.6.37.git/kernel/sched.c
> ===================================================================
> --- linux-2.6.37.git.orig/kernel/sched.c
> +++ linux-2.6.37.git/kernel/sched.c
> @@ -9193,6 +9193,16 @@ cpu_cgroup_attach(struct cgroup_subsys *
>  static void
>  cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task)
>  {
> +	/*
> +	 * cgroup_exit() is called in the copy_process failure path.
> +	 * The task isn't hashed, and we don't want to make autogroup
> +	 * dig into a freed signal_struct, so just go away.
> +	 *
> +	 * XXX: why are cgroup methods diddling unattached tasks?
> +	 */
> +	if (!(task->flags & PF_EXITING))
> +		return;
> +
>  	sched_move_task(task);
>  }

Ah, that looks plausible. I've folded this chunk into my patch and kept
your fork-fail mod in a separate patch.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/