On Thu, Feb 15, 2018 at 02:22:39PM +0000, Will Deacon wrote: > Instead, we've come up with a more plausible sequence that can in theory > happen on a single CPU: > > <task foo calls exit()> > > do_exit > exit_mm > mmgrab(mm); // foo's mm has count +1 > BUG_ON(mm != current->active_mm); > task_lock(current); > current->mm = NULL; > task_unlock(current); > > <irq and ctxsw to kthread>
[...] > mmdrop(mm); // foo's mm has count -1 > > At this point, we've got an imbalanced count on the mm and could free it > prematurely as seen in the KASAN log. A subsequent context-switch away > from foo would therefore result in a use-after-free. Peter already dismissed an algorithm issue here but I thought I'd give model checking a go (it only deals with mm_users/mm_count; also added a heavily simplified exec_mmap() in the loop): https://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/kernel-tla.git/tree/ctxsw.tla As expected, it didn't show any problems (though it does not take memory ordering into account). Now, there are lots of other mmget/mmput and mmgrab/mmdrop throughout the kernel and finding an imbalanced call needs more work. -- Catalin
