On Fri, Jun 28, 2019 at 10:46:08PM +0200, Peter Zijlstra wrote:
> On Fri, Jun 28, 2019 at 05:50:03PM +0100, Mark Rutland wrote:
> > > + /*
> > > + * Wake any perf_event_free_task() waiting for this event to be
> > > + * freed.
> > > + */
> > > + smp_mb();
On Fri, Jun 28, 2019 at 05:50:03PM +0100, Mark Rutland wrote:
> > + /*
> > +* Wake any perf_event_free_task() waiting for this event to be
> > +* freed.
> > +*/
> > + smp_mb(); /* pairs with wait_var_event() */
> > +
On Tue, Jun 25, 2019 at 12:43:20PM +0200, Peter Zijlstra wrote:
>
> Syzcaller reported the following Use-after-Free issue:
>
> close() clone()
>
> copy_process()
>
Peter Zijlstra writes:
> Solve it by using the fact that detached events still have a reference
> count on their (previous) context. With this perf_event_free_task()
> can detect when events have escaped and wait for their destruction.
>
> Cc: Mark Rutland
> Fixes: 82d94856fa22 ("perf/core: Fix
Syzcaller reported the following Use-after-Free issue:
close() clone()
copy_process()
perf_event_init_task()
5 matches
Mail list logo