OSDN Git Service

sched/walt: Fix use after free in trace_sched_update_task_ravg()
authorPavankumar Kondeti <pkondeti@codeaurora.org>
Tue, 13 Mar 2018 10:33:15 +0000 (16:03 +0530)
committerGerrit - the friendly Code Review server <code-review@localhost>
Thu, 3 May 2018 04:46:48 +0000 (21:46 -0700)
commitc6a5b958e655d6d23bdede8103876d5ffe1c56b6
tree1b0a2952a572cbf7e2fe6241cd3253463d153586
parentcb0e8e7c96590b4df7485c2c815fc131b7838325
sched/walt: Fix use after free in trace_sched_update_task_ravg()

commit 4d09122c1868 ("sched: Fix spinlock recursion in sched_exit()")
moved freeing of task's current and previous window arrays outside
the rq->lock. These arrays can be accessed from another CPU in parallel
and end up using freed memory. For example,

CPU#0                                 CPU#1
----------------------------------    -------------------------------
sched_exit()                          try_to_wake_up()--> The task wakes
                                                          up on CPU#0
 task_rq_lock()                        set_task_cpu()
                                        fixup_busy_time() --> waiting for
                  CPU#0's rq->lock

 task_rq_unlock()                       fixup_busy_time()-->lock acquired
 free_task_load_ptrs()
  kfree(p->ravg.curr_window_cpu)         update_task_ravg()-->called on
                                                          current of CPU#0
  trace_sched_update_task_ravg()
          --> access freed memory
  p->ravg.curr_window_cpu = NULL;

To fix this issue, window array pointers must be set to NULL before
freeing the memory. Since this happens outside the lock, memory barriers
are needed on write and read paths. A much simpler alternative would be
skipping update_task_ravg() trace point for tasks that are marked as dead.
The window stats of dead tasks are not updated any ways. While at it, skip
this trace point for newly created tasks for which also window stats are
not updated.

Change-Id: I4d7cb8a3cf7cf84270b09721140d35205643b7ab
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
[spathi@codeaurora.org: moved changes to hmp.c since EAS is not supported]
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
kernel/sched/hmp.c