linux-kernel - Re: [PATCH v2 3/7] mm/mremap: introduce and use vma_remap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f3f1c8cb-b553-44b7-8c7d-7ac2e267f849@lucifer.local>
Date: Mon, 10 Mar 2025 10:19:17 +0000
From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: "Liam R . Howlett" <Liam.Howlett@...cle.com>,
        Vlastimil Babka <vbabka@...e.cz>, Jann Horn <jannh@...gle.com>,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Harry Yoo <harry.yoo@...cle.com>, Yosry Ahmed <yosry.ahmed@...ux.dev>,
        oliver.sang@...el.com
Subject: Re: [PATCH v2 3/7] mm/mremap: introduce and use vma_remap_struct
 threaded state

On Thu, Mar 06, 2025 at 10:33:59AM +0000, Lorenzo Stoakes wrote:
> A number of mremap() calls both pass around and modify a large number of
> parameters, making the code less readable and often repeatedly having to
> determine things such as VMA, size delta, and more.

[snip]

Hi Andrew,

I have a small fixpatch to address a corner case below, please apply!

I have checked locally and this applies cleanly at this patch and causes no
merge conflicts when subsequent patches are applied on top.

Thanks, Lorenzo

----8<----
>From 14a22fa872e19b468b6d06c15205efe77e460ce4 Mon Sep 17 00:00:00 2001
From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
Date: Mon, 10 Mar 2025 10:13:17 +0000
Subject: [PATCH] always check if !vma

We perform VMA lookup in a couple more places which, in theory, can
unexpectedly fail to find a VMA.

In these cases, correctly indicate failure.

Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
Reported-by: kernel test robot <oliver.sang@...el.com>
Closes: https://lore.kernel.org/oe-lkp/202503101328.442cc724-lkp@intel.com
---
 mm/mremap.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index 0ab0c88072a0..af022e3b89e2 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -1066,10 +1066,13 @@ static unsigned long shrink_vma(struct vma_remap_struct *vrm,
 	 * replace the invalidated VMA with the one that may have now been
 	 * split.
 	 */
-	if (drop_lock)
+	if (drop_lock) {
 		vrm->mmap_locked = false;
-	else
+	} else {
 		vrm->vma = vma_lookup(mm, vrm->addr);
+		if (!vrm->vma)
+			return -EFAULT;
+	}

 	return 0;
 }
@@ -1108,6 +1111,8 @@ static unsigned long mremap_to(struct vma_remap_struct *vrm)
 		 * this can invalidate the old VMA. Reset.
 		 */
 		vrm->vma = vma_lookup(mm, vrm->addr);
+		if (!vrm->vma)
+			return -EFAULT;
 	}

 	if (vrm->remap_type == MREMAP_SHRINK) {
--
2.48.1