Re: sched, timers: use after free in __lock_task_sighand when exiting a process
From: Peter Zijlstra
Date: Tue Jul 15 2014 - 09:28:22 EST
On Mon, Jul 14, 2014 at 04:49:53PM +0200, Oleg Nesterov wrote:
> > Oleg, what guarantees the RCU free of task-struct and sighand?
> > The only RCU I can find is delayed_put_task_struct() but that's not
> > often used.
> Yes, usually the code uses put_task_struct(). delayed_put_task_struct()
> acts almost as "if (dec_and_test(usage)) kfree_rcu(), but allows to use
> get_task_struct() if you observe this task under rcu_read_lock().
> task = find_task_by_vpid(...);
> if (task)
> If release_task() used dec_and_test + kfree_rcu, the code above could
> not work.
> > TASK_DEAD etc. use regular put_task_struct() and that
> > doesn't seem to involve RCU.
> Yes, the task itself (or, depending ob pov, scheduler) has a reference.
> copy_process() does
> * One for us, one for whoever does the "release_task()" (usually
> * parent)
> atomic_set(&tsk->usage, 2);
> "us" actually means that put_task_struct(TASK_DEAD).
Right, that's it. I got confused in the exit code. Thanks!
Description: PGP signature