[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240413233341.1957-1-hdanton@sina.com>
Date: Sun, 14 Apr 2024 07:33:41 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+ad1b592fc4483655438b@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] KASAN: slab-use-after-free Read in __vma_reservation_common
On Sat, 13 Apr 2024 11:34:32 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 9ed46da14b9b Add linux-next specific files for 20240412
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=12bd4457180000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7ea0abc478c49859
> dashboard link: https://syzkaller.appspot.com/bug?extid=ad1b592fc4483655438b
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1370ea67180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 9ed46da14b9b
--- x/mm/mmap.c
+++ y/mm/mmap.c
@@ -2657,8 +2657,6 @@ do_vmi_align_munmap(struct vma_iterator
/* Point of no return */
mm->locked_vm -= locked_vm;
mm->map_count -= count;
- if (unlock)
- mmap_write_downgrade(mm);
prev = vma_iter_prev_range(vmi);
next = vma_next(vmi);
@@ -2677,7 +2675,7 @@ do_vmi_align_munmap(struct vma_iterator
remove_mt(mm, &mas_detach);
validate_mm(mm);
if (unlock)
- mmap_read_unlock(mm);
+ mmap_write_unlock(mm);
__mt_destroy(&mt_detach);
return 0;
--
Powered by blists - more mailing lists