Messages in this thread | | | Date | Fri, 16 Feb 2018 09:11:27 +0100 | From | Peter Zijlstra <> | Subject | Re: arm64/v4.16-rc1: KASAN: use-after-free Read in finish_task_switch |
| |
Please trim..
On Fri, Feb 16, 2018 at 12:02:42AM +0000, Mathieu Desnoyers wrote: > > My current theory: do_exit() gets preempted after having set current->mm > > to NULL, and after having issued mmput(), which brings the mm_count down > > to 0.
No it doesn't..
remember, the last thread of a process enters with:
mm_count == 1 && mm_users == 1
exit_mm() then does mmgrab():
mm_count == 2 && mm_users == 1
we then do mmput(), which results in:
mm_count == 1 && mm_users == 0
That last mm_count is for ->active_mm, and will be dropped once we schedule to a next user task.
| |