Revision 1dff76b92f69051e579bdc131e01500da9fa2a91 authored by Gavin Guo on 20 January 2016, 04:36:58 UTC, committed by Ingo Molnar on 22 January 2016, 12:51:04 UTC
The following message can be observed on the Ubuntu v3.13.0-65 with KASan backported: ================================================================== BUG: KASan: use after free in task_numa_find_cpu+0x64c/0x890 at addr ffff880dd393ecd8 Read of size 8 by task qemu-system-x86/3998900 ============================================================================= BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in task_numa_fault+0xc1b/0xed0 age=41980 cpu=18 pid=3998890 __slab_alloc+0x4f8/0x560 __kmalloc+0x1eb/0x280 task_numa_fault+0xc1b/0xed0 do_numa_page+0x192/0x200 handle_mm_fault+0x808/0x1160 __do_page_fault+0x218/0x750 do_page_fault+0x1a/0x70 page_fault+0x28/0x30 SyS_poll+0x66/0x1a0 system_call_fastpath+0x1a/0x1f INFO: Freed in task_numa_free+0x1d2/0x200 age=62 cpu=18 pid=0 __slab_free+0x2ab/0x3f0 kfree+0x161/0x170 task_numa_free+0x1d2/0x200 finish_task_switch+0x1d2/0x210 __schedule+0x5d4/0xc60 schedule_preempt_disabled+0x40/0xc0 cpu_startup_entry+0x2da/0x340 start_secondary+0x28f/0x360 Call Trace: [<ffffffff81a6ce35>] dump_stack+0x45/0x56 [<ffffffff81244aed>] print_trailer+0xfd/0x170 [<ffffffff8124ac36>] object_err+0x36/0x40 [<ffffffff8124cbf9>] kasan_report_error+0x1e9/0x3a0 [<ffffffff8124d260>] kasan_report+0x40/0x50 [<ffffffff810dda7c>] ? task_numa_find_cpu+0x64c/0x890 [<ffffffff8124bee9>] __asan_load8+0x69/0xa0 [<ffffffff814f5c38>] ? find_next_bit+0xd8/0x120 [<ffffffff810dda7c>] task_numa_find_cpu+0x64c/0x890 [<ffffffff810de16c>] task_numa_migrate+0x4ac/0x7b0 [<ffffffff810de523>] numa_migrate_preferred+0xb3/0xc0 [<ffffffff810e0b88>] task_numa_fault+0xb88/0xed0 [<ffffffff8120ef02>] do_numa_page+0x192/0x200 [<ffffffff81211038>] handle_mm_fault+0x808/0x1160 [<ffffffff810d7dbd>] ? sched_clock_cpu+0x10d/0x160 [<ffffffff81068c52>] ? native_load_tls+0x82/0xa0 [<ffffffff81a7bd68>] __do_page_fault+0x218/0x750 [<ffffffff810c2186>] ? hrtimer_try_to_cancel+0x76/0x160 [<ffffffff81a6f5e7>] ? schedule_hrtimeout_range_clock.part.24+0xf7/0x1c0 [<ffffffff81a7c2ba>] do_page_fault+0x1a/0x70 [<ffffffff81a772e8>] page_fault+0x28/0x30 [<ffffffff8128cbd4>] ? do_sys_poll+0x1c4/0x6d0 [<ffffffff810e64f6>] ? enqueue_task_fair+0x4b6/0xaa0 [<ffffffff810233c9>] ? sched_clock+0x9/0x10 [<ffffffff810cf70a>] ? resched_task+0x7a/0xc0 [<ffffffff810d0663>] ? check_preempt_curr+0xb3/0x130 [<ffffffff8128b5c0>] ? poll_select_copy_remaining+0x170/0x170 [<ffffffff810d3bc0>] ? wake_up_state+0x10/0x20 [<ffffffff8112a28f>] ? drop_futex_key_refs.isra.14+0x1f/0x90 [<ffffffff8112d40e>] ? futex_requeue+0x3de/0xba0 [<ffffffff8112e49e>] ? do_futex+0xbe/0x8f0 [<ffffffff81022c89>] ? read_tsc+0x9/0x20 [<ffffffff8111bd9d>] ? ktime_get_ts+0x12d/0x170 [<ffffffff8108f699>] ? timespec_add_safe+0x59/0xe0 [<ffffffff8128d1f6>] SyS_poll+0x66/0x1a0 [<ffffffff81a830dd>] system_call_fastpath+0x1a/0x1f As commit 1effd9f19324 ("sched/numa: Fix unsafe get_task_struct() in task_numa_assign()") points out, the rcu_read_lock() cannot protect the task_struct from being freed in the finish_task_switch(). And the bug happens in the process of calculation of imp which requires the access of p->numa_faults being freed in the following path: do_exit() current->flags |= PF_EXITING; release_task() ~~delayed_put_task_struct()~~ schedule() ... ... rq->curr = next; context_switch() finish_task_switch() put_task_struct() __put_task_struct() task_numa_free() The fix here to get_task_struct() early before end of dst_rq->lock to protect the calculation process and also put_task_struct() in the corresponding point if finally the dst_rq->curr somehow cannot be assigned. Additional credit to Liang Chen who helped fix the error logic and add the put_task_struct() to the place it missed. Signed-off-by: Gavin Guo <gavin.guo@canonical.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Hugh Dickins <hughd@google.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mel Gorman <mgorman@suse.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Rik van Riel <riel@redhat.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: jay.vosburgh@canonical.com Cc: liang.chen@canonical.com Link: http://lkml.kernel.org/r/1453264618-17645-1-git-send-email-gavin.guo@canonical.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
1 parent 9c03ee1
File | Mode | Size |
---|---|---|
asymmetric_keys | ||
async_tx | ||
.gitignore | -rw-r--r-- | 12 bytes |
842.c | -rw-r--r-- | 2.6 KB |
Kconfig | -rw-r--r-- | 46.8 KB |
Makefile | -rw-r--r-- | 4.8 KB |
ablk_helper.c | -rw-r--r-- | 4.2 KB |
ablkcipher.c | -rw-r--r-- | 17.9 KB |
aead.c | -rw-r--r-- | 10.0 KB |
aes_generic.c | -rw-r--r-- | 62.0 KB |
af_alg.c | -rw-r--r-- | 9.8 KB |
ahash.c | -rw-r--r-- | 14.8 KB |
akcipher.c | -rw-r--r-- | 3.9 KB |
algapi.c | -rw-r--r-- | 20.6 KB |
algboss.c | -rw-r--r-- | 6.3 KB |
algif_aead.c | -rw-r--r-- | 13.6 KB |
algif_hash.c | -rw-r--r-- | 6.7 KB |
algif_rng.c | -rw-r--r-- | 5.2 KB |
algif_skcipher.c | -rw-r--r-- | 18.3 KB |
ansi_cprng.c | -rw-r--r-- | 10.9 KB |
anubis.c | -rw-r--r-- | 27.8 KB |
api.c | -rw-r--r-- | 13.8 KB |
arc4.c | -rw-r--r-- | 3.4 KB |
authenc.c | -rw-r--r-- | 13.7 KB |
authencesn.c | -rw-r--r-- | 14.9 KB |
blkcipher.c | -rw-r--r-- | 20.0 KB |
blowfish_common.c | -rw-r--r-- | 15.7 KB |
blowfish_generic.c | -rw-r--r-- | 3.4 KB |
camellia_generic.c | -rw-r--r-- | 34.9 KB |
cast5_generic.c | -rw-r--r-- | 20.9 KB |
cast6_generic.c | -rw-r--r-- | 9.5 KB |
cast_common.c | -rw-r--r-- | 13.1 KB |
cbc.c | -rw-r--r-- | 7.5 KB |
ccm.c | -rw-r--r-- | 22.5 KB |
chacha20_generic.c | -rw-r--r-- | 6.0 KB |
chacha20poly1305.c | -rw-r--r-- | 19.2 KB |
chainiv.c | -rw-r--r-- | 7.6 KB |
cipher.c | -rw-r--r-- | 3.3 KB |
cmac.c | -rw-r--r-- | 7.5 KB |
compress.c | -rw-r--r-- | 1.3 KB |
crc32.c | -rw-r--r-- | 3.7 KB |
crc32c_generic.c | -rw-r--r-- | 4.4 KB |
crct10dif_common.c | -rw-r--r-- | 3.6 KB |
crct10dif_generic.c | -rw-r--r-- | 3.2 KB |
cryptd.c | -rw-r--r-- | 26.1 KB |
crypto_null.c | -rw-r--r-- | 5.3 KB |
crypto_user.c | -rw-r--r-- | 12.8 KB |
crypto_wq.c | -rw-r--r-- | 972 bytes |
ctr.c | -rw-r--r-- | 12.3 KB |
cts.c | -rw-r--r-- | 9.8 KB |
deflate.c | -rw-r--r-- | 5.4 KB |
des_generic.c | -rw-r--r-- | 35.7 KB |
drbg.c | -rw-r--r-- | 56.0 KB |
ecb.c | -rw-r--r-- | 4.9 KB |
echainiv.c | -rw-r--r-- | 5.9 KB |
eseqiv.c | -rw-r--r-- | 5.9 KB |
fcrypt.c | -rw-r--r-- | 18.0 KB |
fips.c | -rw-r--r-- | 1.6 KB |
gcm.c | -rw-r--r-- | 32.9 KB |
gf128mul.c | -rw-r--r-- | 13.2 KB |
ghash-generic.c | -rw-r--r-- | 3.7 KB |
hash_info.c | -rw-r--r-- | 1.8 KB |
hmac.c | -rw-r--r-- | 6.8 KB |
internal.h | -rw-r--r-- | 4.1 KB |
jitterentropy-kcapi.c | -rw-r--r-- | 5.7 KB |
jitterentropy.c | -rw-r--r-- | 23.9 KB |
keywrap.c | -rw-r--r-- | 12.6 KB |
khazad.c | -rw-r--r-- | 51.8 KB |
lrw.c | -rw-r--r-- | 9.2 KB |
lz4.c | -rw-r--r-- | 2.5 KB |
lz4hc.c | -rw-r--r-- | 2.6 KB |
lzo.c | -rw-r--r-- | 2.6 KB |
mcryptd.c | -rw-r--r-- | 17.9 KB |
md4.c | -rw-r--r-- | 6.2 KB |
md5.c | -rw-r--r-- | 4.1 KB |
memneq.c | -rw-r--r-- | 6.1 KB |
michael_mic.c | -rw-r--r-- | 3.6 KB |
pcbc.c | -rw-r--r-- | 7.7 KB |
pcompress.c | -rw-r--r-- | 2.9 KB |
pcrypt.c | -rw-r--r-- | 13.2 KB |
poly1305_generic.c | -rw-r--r-- | 8.0 KB |
proc.c | -rw-r--r-- | 3.0 KB |
ripemd.h | -rw-r--r-- | 974 bytes |
rmd128.c | -rw-r--r-- | 10.2 KB |
rmd160.c | -rw-r--r-- | 12.6 KB |
rmd256.c | -rw-r--r-- | 10.6 KB |
rmd320.c | -rw-r--r-- | 13.1 KB |
rng.c | -rw-r--r-- | 5.0 KB |
rsa-pkcs1pad.c | -rw-r--r-- | 16.3 KB |
rsa.c | -rw-r--r-- | 6.5 KB |
rsa_helper.c | -rw-r--r-- | 3.3 KB |
rsaprivkey.asn1 | -rw-r--r-- | 231 bytes |
rsapubkey.asn1 | -rw-r--r-- | 82 bytes |
salsa20_generic.c | -rw-r--r-- | 6.7 KB |
scatterwalk.c | -rw-r--r-- | 3.9 KB |
seed.c | -rw-r--r-- | 17.4 KB |
seqiv.c | -rw-r--r-- | 8.9 KB |
serpent_generic.c | -rw-r--r-- | 21.2 KB |
sha1_generic.c | -rw-r--r-- | 2.6 KB |
sha256_generic.c | -rw-r--r-- | 11.0 KB |
sha512_generic.c | -rw-r--r-- | 7.1 KB |
shash.c | -rw-r--r-- | 17.5 KB |
skcipher.c | -rw-r--r-- | 7.3 KB |
tcrypt.c | -rw-r--r-- | 53.2 KB |
tcrypt.h | -rw-r--r-- | 4.3 KB |
tea.c | -rw-r--r-- | 6.6 KB |
testmgr.c | -rw-r--r-- | 85.5 KB |
testmgr.h | -rw-r--r-- | 1.2 MB |
tgr192.c | -rw-r--r-- | 30.5 KB |
twofish_common.c | -rw-r--r-- | 37.8 KB |
twofish_generic.c | -rw-r--r-- | 6.3 KB |
vmac.c | -rw-r--r-- | 18.9 KB |
wp512.c | -rw-r--r-- | 59.8 KB |
xcbc.c | -rw-r--r-- | 7.2 KB |
xor.c | -rw-r--r-- | 4.0 KB |
xts.c | -rw-r--r-- | 8.7 KB |
zlib.c | -rw-r--r-- | 9.6 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...