fork: fix incorrect fput of ->exe_file causing use-after-free

commit 2b7e8665b4ff51c034c55df3cff76518d1a9ee3a upstream.

Commit 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for
write killable") made it possible to kill a forking task while it is
waiting to acquire its ->mmap_sem for write, in dup_mmap().

However, it was overlooked that this introduced an new error path before
a reference is taken on the mm_struct's ->exe_file.  Since the
->exe_file of the new mm_struct was already set to the old ->exe_file by
the memcpy() in dup_mm(), it was possible for the mmput() in the error
path of dup_mm() to drop a reference to ->exe_file which was never

This caused the struct file to later be freed prematurely.

Fix it by updating mm_init() to NULL out the ->exe_file, in the same
place it clears other things like the list of mmaps.

This bug was found by syzkaller.  It can be reproduced using the
following C program:

    #define _GNU_SOURCE
    #include <pthread.h>
    #include <stdlib.h>
    #include <sys/mman.h>
    #include <sys/syscall.h>
    #include <sys/wait.h>
    #include <unistd.h>

    static void *mmap_thread(void *_arg)
        for (;;) {
            mmap(NULL, 0x1000000, PROT_READ,

    static void *fork_thread(void *_arg)
        usleep(rand() % 10000);

    int main(void)
        for (;;) {
            if (fork() == 0) {
                pthread_t t;

                pthread_create(&t, NULL, mmap_thread, NULL);
                pthread_create(&t, NULL, fork_thread, NULL);
                usleep(rand() % 10000);
                syscall(__NR_exit_group, 0);

No special kernel config options are needed.  It usually causes a NULL
pointer dereference in __remove_shared_vm_struct() during exit, or in
dup_mmap() (which is usually inlined into copy_process()) during fork.
Both are due to a vm_area_struct's ->vm_file being used after it's
already been freed.

Google Bug Id: 64772007

Fixes: 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for write killable")
Signed-off-by: Eric Biggers <>
Tested-by: Mark Rutland <>
Acked-by: Michal Hocko <>
Cc: Dmitry Vyukov <>
Cc: Ingo Molnar <>
Cc: Konstantin Khlebnikov <>
Cc: Oleg Nesterov <>
Cc: Peter Zijlstra <>
Cc: Vlastimil Babka <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>

diff --git a/kernel/fork.c b/kernel/fork.c
index 59faac4..50bf262 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -766,6 +766,7 @@
 	mm_init_owner(mm, p);
+	RCU_INIT_POINTER(mm->exe_file, NULL);