linux-kernel - Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_46109430EBAEEFDACC98796A6F202EDD6C0A@qq.com>
Date: Tue,  4 Mar 2025 22:33:33 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+8f9f411152c9539f4e59@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [xfs?] [mm?] WARNING: bad unlock balance in __mm_populate

#syz test

diff --git a/mm/gup.c b/mm/gup.c
index 3883b307780e..10be47b303a0 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2029,7 +2029,15 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
 		 * double checks the vma flags, so that it won't mlock pages
 		 * if the vma was already munlocked.
 		 */
+		printk("1mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+			mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
 		ret = populate_vma_page_range(vma, nstart, nend, &locked);
+		printk("mm: %p, vma: %p, mmap lock held: %d, locked: %d, ret: %ld, mm addr is valid: %d, %s\n",
+			mm, vma, lockdep_is_held(&mm->mmap_lock), locked, ret, virt_addr_valid((void*)mm), __func__);
+
+		if (!virt_addr_valid((void*)mm)) {
+			return -EFAULT;
+		}
 		if (ret < 0) {
 			if (ignore_errors) {
 				ret = 0;
diff --git a/mm/util.c b/mm/util.c
index b6b9684a1438..f6aa733b9563 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -576,6 +576,7 @@ unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr,
 			      &uf);
 		mmap_write_unlock(mm);
 		userfaultfd_unmap_complete(mm, &uf);
+		printk("mm: %p, pop: %lu, %s\n", mm, populate, __func__);
 		if (populate)
 			mm_populate(ret, populate);
 	}