linux-kernel - [PATCH] mm: fix copy_vma() error handling for hugetlb mappings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250523-warning_in_page_counter_cancel-v1-1-b221eb61a402@igalia.com>
Date: Fri, 23 May 2025 09:56:18 +0200
From: Ricardo Cañuelo Navarro <rcn@...lia.com>
To: Andrew Morton <akpm@...ux-foundation.org>, 
 "Liam R. Howlett" <Liam.Howlett@...cle.com>, 
 Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, 
 Vlastimil Babka <vbabka@...e.cz>, Jann Horn <jannh@...gle.com>, 
 Pedro Falcato <pfalcato@...e.de>
Cc: revest@...gle.com, kernel-dev@...lia.com, linux-mm@...ck.org, 
 linux-kernel@...r.kernel.org, 
 Ricardo Cañuelo Navarro <rcn@...lia.com>, 
 stable@...r.kernel.org
Subject: [PATCH] mm: fix copy_vma() error handling for hugetlb mappings

If, during a mremap() operation for a hugetlb-backed memory mapping,
copy_vma() fails after the source vma has been duplicated and
opened (ie. vma_link() fails), the error is handled by closing the new
vma. This updates the hugetlbfs reservation counter of the reservation
map which at this point is referenced by both the source vma and the new
copy. As a result, once the new vma has been freed and copy_vma()
returns, the reservation counter for the source vma will be incorrect.

This patch addresses this corner case by clearing the hugetlb private
page reservation reference for the new vma and decrementing the
reference before closing the vma, so that vma_close() won't update the
reservation counter.

The issue was reported by a private syzbot instance, see the error
report log [1] and reproducer [2]. Possible duplicate of public syzbot
report [3].

Signed-off-by: Ricardo Cañuelo Navarro <rcn@...lia.com>
Cc: stable@...r.kernel.org # 6.12+
Link: https://people.igalia.com/rcn/kernel_logs/20250422__WARNING_in_page_counter_cancel.txt [1]
Link: https://people.igalia.com/rcn/kernel_logs/20250422__WARNING_in_page_counter_cancel__repro.c [2]
Link: https://lore.kernel.org/all/67000a50.050a0220.49194.048d.GAE@google.com/ [3]
---
 mm/vma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/vma.c b/mm/vma.c
index 839d12f02c885d3338d8d233583eb302d82bb80b..9d9f699ace977c9c869e5da5f88f12be183adcfb 100644
--- a/mm/vma.c
+++ b/mm/vma.c
@@ -1834,6 +1834,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
 	return new_vma;

 out_vma_link:
+	if (is_vm_hugetlb_page(new_vma))
+		clear_vma_resv_huge_pages(new_vma);
 	vma_close(new_vma);

 	if (new_vma->vm_file)

---
base-commit: 94305e83eccb3120c921cd3a015cd74731140bac
change-id: 20250523-warning_in_page_counter_cancel-e8c71a6b4c88