summaryrefslogtreecommitdiff
path: root/include/linux/refcount.h
diff options
context:
space:
mode:
authorQian Cai <cai@lca.pw>2020-03-30 17:30:02 -0400
committerIngo Molnar <mingo@kernel.org>2020-04-08 12:05:06 +0200
commitd22cc7f67d55ebf2d5be865453971c783e9fb21a (patch)
tree1330785754a3c2b269d797a9da763011e37e39ec /include/linux/refcount.h
parentf5e94d10e4c468357019e5c28d48499f677b284f (diff)
locking/percpu-rwsem: Fix a task_struct refcount
The following commit: 7f26482a872c ("locking/percpu-rwsem: Remove the embedded rwsem") introduced task_struct memory leaks due to messing up the task_struct refcount. At the beginning of percpu_rwsem_wake_function(), it calls get_task_struct(), but if the trylock failed, it will remain in the waitqueue. However, it will run percpu_rwsem_wake_function() again with get_task_struct() to increase the refcount but then only call put_task_struct() once the trylock succeeded. Fix it by adjusting percpu_rwsem_wake_function() a bit to guard against when percpu_rwsem_wait() observing !private, terminating the wait and doing a quick exit() while percpu_rwsem_wake_function() then doing wake_up_process(p) as a use-after-free. Fixes: 7f26482a872c ("locking/percpu-rwsem: Remove the embedded rwsem") Suggested-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Qian Cai <cai@lca.pw> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://lkml.kernel.org/r/20200330213002.2374-1-cai@lca.pw
Diffstat (limited to 'include/linux/refcount.h')
0 files changed, 0 insertions, 0 deletions