On 04/09, Peter Zijlstra wrote: > > On Tue, Mar 06, 2018 at 06:49:10PM +0900, Prashant Bhole wrote: > > Sorry for late reply. I tried these changes. It didn't fix the problem. With > > He, sorry for completely forgetting about this one :/
me too, sorry Prashant, > > these changes, the use-after-free access of task_struct occurs at > > _free_event() for the last remaining event. Heh, I didn't even try to compile the "patch" I sent, I am not surprised it is not correct. But unless I forget again, I'll try to make the working version. > > In your changes, I tried keeping get/put_task_struct() in > > perf_alloc_context()/put_ctx() intact and The problem did not occur. Change > > are mentioned below. > > Yes, I think you're right in that this is the cleanest solution; it add > reference counting to the exact pointer we're using. OK, agreed, lets make the minimal fix for now. But I still think that we should (try to) remove put_task_struct() from put_ctx(). Quite possibly I missed something, but I think it only adds some confusion. Once again, even if ctx can't go away you can't use ctx->task without TASK_TOMBSTONE check, exactly because this task can exit. So why perf_event_context should add another reference? Oleg.
