Re: [PATCH v5] x86/sgx: Fix use-after-free in sgx_mmu_notifier_release()

[Jarkko Sakkinen]

On Wed, Feb 03, 2021 at 07:46:48AM -0800, Dave Hansen wrote:
> On 1/30/21 11:20 AM, Jarkko Sakkinen wrote:
> ...
> > Example scenario would such that all removals "side-channel" through
> > the notifier callback. Then mmu_notifier_unregister() gets called
> > exactly zero times. No MMU notifier srcu sync would be then happening.
> > 
> > NOTE: There's bunch of other examples, I'm just giving one.
> 
> Could you flesh this out a bit?  I don't quite understand the scenario
> from what you describe above.
> 
> In any case, I'm open to other implementations that fix the race we know
> about.  If you think you have a better fix, I'm happy to review it and
> make sure it closes the other race.

I'll bake up a new patch. Generally speaking, I think why this has been so
difficult, is because of a chicken-egg-problem. The whole issue should be
sorted when a new entry is first added to the mm_list, i.e. increase the
refcount for each added entry.

/Jarkko