Re: [PATCH-tip v2] sched: Fix use-after-free bug in dup_user_cpus_ptr()

[Peter Zijlstra]

On Mon, Dec 05, 2022 at 11:48:32AM -0500, Waiman Long wrote:
> Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be
> restricted on asymmetric systems"), the setting and clearing of
> user_cpus_ptr are done under pi_lock for arm64 architecture. However,
> dup_user_cpus_ptr() accesses user_cpus_ptr without any lock
> protection. When racing with the clearing of user_cpus_ptr in
> __set_cpus_allowed_ptr_locked(), it can lead to user-after-free and
> double-free in arm64 kernel.

How? the task cannot be in migrate_enable() and fork() at the same time,
no?