Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756492AbdLPAAK (ORCPT ); Fri, 15 Dec 2017 19:00:10 -0500 Received: from mail-pf0-f195.google.com ([209.85.192.195]:46665 "EHLO mail-pf0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755795AbdLPAAI (ORCPT ); Fri, 15 Dec 2017 19:00:08 -0500 X-Google-Smtp-Source: ACJfBovQhimr+Uk9QvHdLfN+4oBJcLgg5qVsNRQ6KygoGHdfGcWBjvE57N1bgoUnSdLKToTmZLyQj/MPUbiscbqOOf4= MIME-Version: 1.0 In-Reply-To: <20171214210817.GF21978@ZenIV.linux.org.uk> References: <20171214201757.5393-1-xiyou.wangcong@gmail.com> <20171214210817.GF21978@ZenIV.linux.org.uk> From: Cong Wang Date: Fri, 15 Dec 2017 15:59:46 -0800 Message-ID: Subject: Re: [PATCH] exit: move exit_task_namespaces() after exit_task_work() To: Al Viro Cc: LKML , Ingo Molnar , Andrew Morton , Linus Torvalds , stable , gscrivan@redhat.com Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1646 Lines: 38 On Thu, Dec 14, 2017 at 1:08 PM, Al Viro wrote: > On Thu, Dec 14, 2017 at 12:17:57PM -0800, Cong Wang wrote: >> syzbot reported we have a use-after-free when mqueue_evict_inode() >> is called on __cleanup_mnt() path, where the ipc ns is already >> freed by the previous exit_task_namespaces(). We can just move >> it after after exit_task_work() to avoid this use-after-free. > > What's to prevent somebody else holding a reference to the same > inode past the exit(2)? IOW, I don't believe that this is fixing > anything - in the best case, your patch papers over a specific > reproducer. You are right, I missed mq_clear_sbinfo(). And the offending commit is: commit 9c583773d036336176e9e50441890659bc4eeae8 Author: Giuseppe Scrivano Date: Fri Dec 15 01:06:28 2017 +0000 ipc, mqueue: lazy call kern_mount_data in new namespaces kern_mount_data is a relatively expensive operation when creating a new IPC namespace, so delay the mount until its first usage when not creating the the global namespace. This is a net saving for new IPC namespaces that don't use mq_open(). In this case there won't be any kern_mount_data() cost at all. On my machine, the time for creating 1000 new IPC namespaces dropped from ~8s to ~2s. Link: http://lkml.kernel.org/r/20171206151422.9660-1-gscrivan@redhat.com Signed-off-by: Giuseppe Scrivano Cc: Manfred Spraul Cc: Davidlohr Bueso Cc: Al Viro Signed-off-by: Andrew Morton