From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753465AbdEJOCk (ORCPT ); Wed, 10 May 2017 10:02:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40920 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753376AbdEJOCg (ORCPT ); Wed, 10 May 2017 10:02:36 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 8FD8180C10 Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=oleg@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 8FD8180C10 Date: Wed, 10 May 2017 16:02:33 +0200 From: Oleg Nesterov To: Vegard Nossum Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Frederic Weisbecker , Jamie Iles , Peter Zijlstra , Thomas Gleixner , Andy Lutomirski Subject: Re: [PATCH v2] kthread: fix use-after-free if kthread fork fails Message-ID: <20170510140232.GA7500@redhat.com> References: <20170509073959.17858-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170509073959.17858-1-vegard.nossum@oracle.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Wed, 10 May 2017 14:02:35 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 05/09, Vegard Nossum wrote: > > If a kthread forks (e.g. usermodehelper since commit 1da5c46fa965) but > fails in copy_process() between calling dup_task_struct() and setting > p->set_child_tid, then the value of p->set_child_tid will be inherited > from the parent and get prematurely freed by free_kthread_struct(). Thanks, Acked-by: Oleg Nesterov