On Thu, 2020-12-03 at 12:31 +0000, Matthew Wilcox wrote:

And this just makes me think RCU freeing of mm_struct.  I'm sure it's
more complicated than that (then, or now), but if an anonymous
process
is borrowing a freed mm, and the mm is freed by RCU then it will not
go
away until the task context switches.  When we context switch back to
the anon task, it'll borrow some other task's MM and won't even
notice
that the MM it was using has gone away.

One major complication here is that most of the
active_mm borrowing is done by the idle task,
but RCU does not wait for idle tasks to context
switch.

That means RCU, as it is today, is not a
mechanism that mm_struct freeing could just
piggyback off.

-- 
All Rights Reversed.