Re: perf: use-after-free in perf_release
From: Oleg Nesterov
Date: Tue Mar 14 2017 - 11:39:06 EST
On 03/14, Peter Zijlstra wrote:
>
> Do we want a WARN_ON_ONCE(atomic_read(&tsk->usage)); in free_task()?
> Because in the above scenario we're freeing it with references on.
Not sure, in this case copy_process() should decrement tsk->usage
before free_task(), note the atomic_set(&tsk->usage, 2) in
dup_task_struct().
Perhaps we should just add WARN_ON(tsk->usage != 2) into copy_process()
right before free_task() ?
On the other hand, WARN_ON(atomic_read(&tsk->usage)) looks pointless,
the only caller is put_task_struct().
Oleg.