From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1163468AbbKTUsS (ORCPT ); Fri, 20 Nov 2015 15:48:18 -0500 Received: from mail-yk0-f181.google.com ([209.85.160.181]:34036 "EHLO mail-yk0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1161971AbbKTUsQ (ORCPT ); Fri, 20 Nov 2015 15:48:16 -0500 Date: Fri, 20 Nov 2015 15:48:13 -0500 From: Tejun Heo To: Dave Jones Cc: Linux Kernel , cgroups@vger.kernel.org Subject: Re: pids_free double free. Message-ID: <20151120204813.GB1574@mtj.duckdns.org> References: <20151120041836.GA18390@codemonkey.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151120041836.GA18390@codemonkey.org.uk> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, Dave. On Thu, Nov 19, 2015 at 11:18:36PM -0500, Dave Jones wrote: > One of my debian boxes got a systemd update. After rebooting, > I started seeing a use-after-free trace, followed by a lockup. > > I have two slightly different traces from separate boots, > which may give some clue as to how it's getting free'd in two ways.. > > http://codemonkey.org.uk/junk/IMG_0474.jpg > http://codemonkey.org.uk/junk/IMG_0476.jpg > > This isn't new, I booted back to 4.3, and hit slab debugging warnings > from the same code. (At the least it was broken differently) > > The WARN_ON referenced in the 2nd trace is this.. > > static void pids_cancel(struct pids_cgroup *pids, int num) > { > /* > * A negative count (or overflow for that matter) is invalid, > * and indicates a bug in the `pids` controller proper. > */ > WARN_ON_ONCE(atomic64_add_negative(-num, &pids->counter)); > } I *think* I know what's going on. Zombies don't pin the css so if the cgroup gets removed, the free path may end up operating on a css which has already been freed. Will look more into it. Thanks. -- tejun