On 3/10/21 5:37 AM, Filippo Sironi wrote: > We've seen a number of crashes with the following signature: > > BUG: kernel NULL pointer dereference, address: 0000000000000000 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > ... > Oops: 0000 [#1] SMP PTI > ... > RIP: 0010:__rb_erase_color+0xc2/0x260 > ... > Call Trace: > unlink_file_vma+0x36/0x50 > free_pgtables+0x62/0x110 > exit_mmap+0xd5/0x160 > ? put_dec+0x3a/0x90 > ? num_to_str+0xa8/0xc0 > mmput+0x11/0xb0 > do_task_stat+0x940/0xc80 > proc_single_show+0x49/0x80 > ? __check_object_size+0xcc/0x1a0 > seq_read+0xd3/0x400 > vfs_read+0x72/0xb0 > ksys_read+0x9c/0xd0 > do_syscall_64+0x69/0x400 > ? schedule+0x2a/0x90 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > ... > > This happens when a process goes through the tasks stats in procfs while > another is exiting. This looks like a race where the process that's > exiting drops the last reference on the mm (with mmput) while the other > increases it (with mmget). By only increasing when the reference isn't > 0 to begin with, we prevent this from happening.
>From a quick look it looks reasonable, but I don't quite see how we get in the situation of finding a valid ->mm under task_lock() and the mm_users count being 0? I'd like to understand that, because it may just be that your patch just narrows the gap but it's still possible to trigger a use-after-free. Doesn't seem like that would be possible under exit_mm(). -- Jens Axboe
