Re: [PATCH v8 13/19] locking/rwsem: Make rwsem->owner an atomic_long_t

[Peter Zijlstra]

On Sat, Jul 20, 2019 at 09:41:05AM +0100, Luis Henriques wrote:
> [   39.801179] ==================================================================
> [   39.801973] BUG: KASAN: use-after-free in rwsem_down_write_slowpath (/home/miguel/kernel/linux/kernel/locking/rwsem.c:669 /home/miguel/kernel/linux/kernel/locking/rwsem.c:1125) 

That's rwsem_can_spin_on_owner(), specifically line 669 seems to suggest
owner_on_cpu().

So we'd somehow have a dead owner; I'm not immediately seeing how that
can happen.