From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752311AbdCNPjE (ORCPT ); Tue, 14 Mar 2017 11:39:04 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40252 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750847AbdCNPjC (ORCPT ); Tue, 14 Mar 2017 11:39:02 -0400 Date: Tue, 14 Mar 2017 16:37:05 +0100 From: Oleg Nesterov To: Peter Zijlstra Cc: Dmitry Vyukov , Ingo Molnar , Arnaldo Carvalho de Melo , Alexander Shishkin , LKML , Mathieu Desnoyers , syzkaller Subject: Re: perf: use-after-free in perf_release Message-ID: <20170314153705.GB31766@redhat.com> References: <20170306131459.GC6515@twins.programming.kicks-ass.net> <20170307140414.GA31678@redhat.com> <20170307165131.GA6097@redhat.com> <20170314125508.GK3343@twins.programming.kicks-ass.net> <20170314140302.GA28146@redhat.com> <20170314140754.GG3328@twins.programming.kicks-ass.net> <20170314143010.GA30351@redhat.com> <20170314150241.GO5680@worktop> <20170314150739.GD32474@worktop> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170314150739.GD32474@worktop> User-Agent: Mutt/1.5.18 (2008-05-17) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Tue, 14 Mar 2017 15:39:01 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/14, Peter Zijlstra wrote: > > Do we want a WARN_ON_ONCE(atomic_read(&tsk->usage)); in free_task()? > Because in the above scenario we're freeing it with references on. Not sure, in this case copy_process() should decrement tsk->usage before free_task(), note the atomic_set(&tsk->usage, 2) in dup_task_struct(). Perhaps we should just add WARN_ON(tsk->usage != 2) into copy_process() right before free_task() ? On the other hand, WARN_ON(atomic_read(&tsk->usage)) looks pointless, the only caller is put_task_struct(). Oleg.