On Fri, Aug 25, 2017 at 04:40:36PM +0200, Oleg Nesterov wrote:
> On 08/24, Eric Biggers wrote:
> >
> > On Thu, Aug 24, 2017 at 03:20:41PM +0200, Oleg Nesterov wrote:
> > > On 08/23, Eric Biggers wrote:
> > > >
> > > > From: Eric Biggers <ebiggers@xxxxxxxxxx>
> > > >
> > > > Commit 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for
> > > > write killable") made it possible to kill a forking task while it is
> > > > waiting to acquire its ->mmap_sem for write, in dup_mmap(). However, it
> > > > was overlooked that this introduced an new error path before a reference
> > > > is taken on the mm_struct's ->exe_file.
> > >
> > > Hmm. Unless I am totally confused, the same problem with mm->exol_area?
> > > I'll recheck....
> >
> > I'm not sure what you mean by ->exol_area.
>
> I meant mm->uprobes_state.xol_area, sorry
>
Yep, that's a bug too. I was able to cause a use-after-free using the same
reproducer program I gave in my commit message, after setting a uprobe
tracepoint on the beginning of the fork_thread() function. I'll send a patch to
fix it when I have a chance.
Eric