Jann Horn 16d51a590a sched/fair: Don't free p->numa_faults with concurrent readers ... When going through execve(), zero out the NUMA fault statistics instead of freeing them. During execve, the task is reachable through procfs and the scheduler. A concurrent /proc/*/sched reader can read data from a freed ->numa_faults allocation (confirmed by KASAN) and write it back to userspace. I believe that it would also be possible for a use-after-free read to occur through a race between a NUMA fault and execve(): task_numa_fault() can lead to task_numa_compare(), which invokes task_weight() on the currently running task of a different CPU. Another way to fix this would be to make ->numa_faults RCU-managed or add extra locking, but it seems easier to wipe the NUMA fault statistics on execve. Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Petr Mladek <pmladek@suse.com> Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will@kernel.org> Fixes: 82727018b0 ("sched/numa: Call task_numa_free() from do_execve()") Link: https://lkml.kernel.org/r/20190716152047.14424-1-jannh@google.com Signed-off-by: Ingo Molnar <mingo@kernel.org>		2019-07-25 15:37:04 +02:00
..
autogroup.h
clock.h
coredump.h
cpufreq.h
cputime.h
deadline.h
debug.h
hotplug.h
idle.h
init.h
isolation.h	KVM: LAPIC: Inject timer interrupt via posted interrupt	2019-07-20 09:00:40 +02:00
jobctl.h
loadavg.h
mm.h
nohz.h
numa_balancing.h	sched/fair: Don't free p->numa_faults with concurrent readers	2019-07-25 15:37:04 +02:00
prio.h
rt.h
signal.h	signal: simplify set_user_sigmask/restore_user_sigmask	2019-07-16 19:23:24 -07:00
smt.h
stat.h
sysctl.h
task_stack.h
task.h	clone: fix CLONE_PIDFD support	2019-07-14 20:36:12 +02:00
topology.h
user.h
wake_q.h
xacct.h