Re: [PATCH] Detect early free of a live mm

[Mark Rutland]

On Thu, Mar 01, 2018 at 05:16:09PM -0800, Andrew Morton wrote:
> On Wed, 28 Feb 2018 12:14:58 +0000 Mark Rutland <mark.rutland@xxxxxxx> wrote:
> 
> > KASAN splats indicate that in some cases we free a live mm, then
> > continue to access it, with potentially disastrous results. This is
> > likely due to a mismatched mmdrop() somewhere in the kernel, but so far
> > the culprit remains elusive.
> > 
> > Let's have __mmdrop() verify that the mm isn't live for the current
> > task, similar to the existing check for init_mm. This way, we can catch
> > this class of issue earlier, and without requiring KASAN.
> 
> Presumably the results usually aren't disastrous. 

It seems so.

> But they will be if we go and add BUG_ON()s!  Can we make this
> WARN_ON[_ONCE]()?  We should still get the same info from testers.

I fuzz the kernel with panic_on_warn=1, so that's practically the same
for me.

I'll respin to that effect.

Thanks,
Mark.