mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
![]() When going through execve(), zero out the NUMA fault statistics instead of
freeing them.
During execve, the task is reachable through procfs and the scheduler. A
concurrent /proc/*/sched reader can read data from a freed ->numa_faults
allocation (confirmed by KASAN) and write it back to userspace.
I believe that it would also be possible for a use-after-free read to occur
through a race between a NUMA fault and execve(): task_numa_fault() can
lead to task_numa_compare(), which invokes task_weight() on the currently
running task of a different CPU.
Another way to fix this would be to make ->numa_faults RCU-managed or add
extra locking, but it seems easier to wipe the NUMA fault statistics on
execve.
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Fixes:
|
||
---|---|---|
.. | ||
autogroup.h | ||
clock.h | ||
coredump.h | ||
cpufreq.h | ||
cputime.h | ||
deadline.h | ||
debug.h | ||
hotplug.h | ||
idle.h | ||
init.h | ||
isolation.h | ||
jobctl.h | ||
loadavg.h | ||
mm.h | ||
nohz.h | ||
numa_balancing.h | ||
prio.h | ||
rt.h | ||
signal.h | ||
smt.h | ||
stat.h | ||
sysctl.h | ||
task.h | ||
task_stack.h | ||
topology.h | ||
user.h | ||
wake_q.h | ||
xacct.h |