On Mon, 02 Sep 2024 21:06:48 +0200 Sven Schnelle <svens@xxxxxxxxxxxxx> wrote:
> So uprobe_clear_state() in the beginning free's the memory area
> containing the vm_special_mapping data, but exit_mmap() uses this
> address later via vma->vm_private_data (which was set in _install_special_mapping().
>
> The following change fixes this for me, but i'm not sure about any side
> effects:
>
> diff --git a/kernel/fork.c b/kernel/fork.c
> index df8e4575ff01..cfcabba36c93 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -1340,11 +1340,11 @@ static inline void __mmput(struct mm_struct *mm)
> {
> VM_BUG_ON(atomic_read(&mm->mm_users));
>
> - uprobe_clear_state(mm);
> exit_aio(mm);
> ksm_exit(mm);
> khugepaged_exit(mm); /* must run before exit_mmap */
> exit_mmap(mm);
> + uprobe_clear_state(mm);
> mm_put_huge_zero_folio(mm);
> set_mm_exe_file(mm, NULL);
> if (!list_empty(&mm->mmlist)) {
uprobe_clear_state() is a pretty simple low-level thing. Side-effects
seem unlikely?
