2

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very beginning. kfree_rcu is only invoked if atomic_dec_and_test returns 1. How come two threads become racy then? Where is ctx getting used after the free operation?

migrated from unix.stackexchange.com Dec 25 '18 at 4:52

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.