When coredump_finish() releases the threads the wakeup neither holds a reference on the task nor is it inside rcu. The threads don't necessarily need a wakeup to exit. If it gets preempted or was woken for other reasons it sees ->task cleared and exits. So only rcu keeps such a task_struct alive. If the coredump client is preempted between the store and wake_up_process() for longer then try_to_wake_up() takes pi_lock() in freed memory. Hold the rcu across the loop. Fixes: a94e2d408eae ("coredump: kill mm->core_done") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner (Amutable) --- fs/coredump.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/coredump.c b/fs/coredump.c index 791a9268ed96..78ab6cb78be8 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -602,6 +602,8 @@ static void coredump_finish(enum coredump_state state) current->signal->core_state = NULL; spin_unlock_irq(¤t->sighand->siglock); + /* A released thread may exit and be freed before it is woken. */ + guard(rcu)(); while ((curr = next) != NULL) { next = curr->next; task = curr->task; -- 2.53.0