Re: [PATCH] exit: use READ_ONCE() to read mm->owner

[Andrew Morton]

On Tue, 27 Oct 2026 16:09:23 -0400 Mani Tofigh via B4 Relay <devnull+mt4022.columbia.edu@xxxxxxxxxx> wrote:

> mm->owner is written with WRITE_ONCE() when ownership moves to another
> task, but mm_update_next_owner() reads it with a plain load.  The race
> is expected, so read it with READ_ONCE() to match the writer.
> 
>   [   14.915975] BUG: KCSAN: data-race in mm_update_next_owner / try_to_set_owner
> 
>   [   14.916154] write (marked) to 0xff11000004471b80 of 8 bytes by task 71 on cpu 0:
>   [   14.916204]  try_to_set_owner+0x100/0x140
>   [   14.916302]  mm_update_next_owner+0x177/0x300
>   ...
> 
>   [   14.917246] read to 0xff11000004471b80 of 8 bytes by task 75 on cpu 1:
>   [   14.917293]  mm_update_next_owner+0x2a/0x300
>   [   14.917396]  do_exit+0x575/0x18b0
>   ...
> 
>   [   14.923906] value changed: 0xff1100002ec04180 -> 0xff1100002ed3a0c0
> 
> Found with KCSAN while fuzzing under a deterministic hypervisor that's
> currently under development.

We don't want older kernels doing this either, so I suggest

Fixes: cf475ad28ac3 ("cgroups: add an owner to the mm_struct")
Cc: <stable$vger.kernel.org>