Re: [PATCH] perf/core: fix use-after-free in uprobe_perf_close

2018-04-09 Thread Oleg Nesterov
On 04/09, Prashant Bhole wrote: > > It occurs because task_struct is freed before perf_event which refers > to the task and task flags are checked while teardown of the event. > perf_event_alloc() assigns task_struct to hw.target of perf_event, > but there is no reference counting for it. > > As a

Re: [PATCH] perf/core: fix use-after-free in uprobe_perf_close

2018-04-09 Thread Peter Zijlstra
On Mon, Apr 09, 2018 at 07:03:46PM +0900, Prashant Bhole wrote: > A use-after-free bug was caught by KASAN while running usdt related > code. (BCC project. bcc/tests/python/test_usdt2.py) > > > Allocated by task 870: > kasan_kmalloc+0xa0/0xd0 > kmem_cache_alloc_node+0x11a/0x430 > copy_process