A use-after-free flaw was found in rwsem_can_spin_on_owner in kernel/locking/rwsem.c in Linux kernel synchronization mechanism. This flaw can allow a local attacker with root privilege to cause a denial of service (DoS). This vulnerability could even lead to a kernel information leak problem.

For writer, the owner value is cleared on unlock. For reader, it is left intact on unlock for providing better debugging aid on crash dump and the unlock of one reader may not mean the lock is free.

As a result, the owner_on_cpu() shouldn't be used on read-owner as the task pointer value may not be valid and the task structure might have been freed. That is the case in rwsem_can_spin_on_owner() where the following use-after-free error from KASAN may appear under certain circumstances:

  BUG: KASAN: use-after-free in rwsem_down_write_slowpath
  (/home/miguel/kernel/linux/kernel/locking/rwsem.c:669
  /home/miguel/kernel/linux/kernel/locking/rwsem.c:1125)

Reference:
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19318
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2056632.html