linux-kernel - Re: [PATCH 4/4] mm/madvise: remove redundant mmap_lock operations from process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250211063756.5195-1-sj@kernel.org>
Date: Mon, 10 Feb 2025 22:37:55 -0800
From: SeongJae Park <sj@...nel.org>
To: "Lai, Yi" <yi1.lai@...ux.intel.com>
Cc: SeongJae Park <sj@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Liam R. Howlett" <Liam.Howlett@...cle.com>,
	David Hildenbrand <david@...hat.com>,
	Davidlohr Bueso <dave@...olabs.net>,
	Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
	Shakeel Butt <shakeel.butt@...ux.dev>,
	Vlastimil Babka <vbabka@...e.cz>,
	linux-kernel@...r.kernel.org,
	linux-mm@...ck.org,
	yi1.lai@...el.com
Subject: Re: [PATCH 4/4] mm/madvise: remove redundant mmap_lock operations from process_madvise()

Hello Lai,

On Tue, 11 Feb 2025 13:30:49 +0800 "Lai, Yi" <yi1.lai@...ux.intel.com> wrote:

[...]
> Hi SeongJae Park,
> 
> Greetings!
> 
> I used Syzkaller and found that there is WARNING in madvise_unlock in linux-next tag - next-20250210.

Thank you so much for this nice report!  I just sent a fix:
https://lore.kernel.org/20250211063201.5106-1-sj@kernel.org

> 
> After bisection and the first bad commit is:
> "
> ec68fbd9e99f mm/madvise: remove redundant mmap_lock operations from process_madvise()
> "

Nonetheless, I think the real first bad commit is f19c9d7b57cf ("mm/madvise:
split out madvise() behavior execution").  I confirmed I can reproduce the
issue using your reproducer on the commit.  And I think the fix may better to
be squashed into an earlier commit, 948a0a9ea070 ("mm/madvise: split out mmap
locking operations for madvise()").  Please refer to the fix for details about
why I think so, and let me know if anything seems wrong.

Thanks,
SJ

[...]