linux-kernel - Re: [syzbot] Re: [syzbot] [kernel?] WARNING in follow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <000000000000bcfc2e061c61e464@google.com>
Date: Wed, 03 Jul 2024 18:30:35 -0700
From: syzbot <syzbot+35a4414f6e247f515443@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] Re: [syzbot] [kernel?] WARNING in follow_pte

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: [syzbot] [kernel?] WARNING in follow_pte
Author: lizhi.xu@...driver.com

Fixes: c5541ba378e3 ("mm: follow_pte() improvements")
It introduced mmap_assert_locked(mm) in follow_pte.
This case content does not hold mm lock.

#syz test: upstream 734610514cb0

diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c
index bdc2a240c2aa..0f2cfe595686 100644
--- a/arch/x86/mm/pat/memtype.c
+++ b/arch/x86/mm/pat/memtype.c
@@ -954,8 +954,12 @@ static int follow_phys(struct vm_area_struct *vma, unsigned long *prot,
 	pte_t *ptep, pte;
 	spinlock_t *ptl;
 
-	if (follow_pte(vma, vma->vm_start, &ptep, &ptl))
+	mmap_read_lock(vma->mm);
+	if (follow_pte(vma, vma->vm_start, &ptep, &ptl)) {
+		mmap_read_unlock(current->mm);
 		return -EINVAL;
+	}
+	mmap_read_unlock(vma->mm);
 
 	pte = ptep_get(ptep);