linux-kernel - Re: [PATCH v2 5/5] mm/madvise: eliminate very confusing manipulation of prev VMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89491be7-a480-4692-a6cf-ec54e02eb684@suse.cz>
Date: Tue, 24 Jun 2025 19:57:09 +0200
From: Vlastimil Babka <vbabka@...e.cz>
To: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
 Andrew Morton <akpm@...ux-foundation.org>
Cc: David Hildenbrand <david@...hat.com>, Zi Yan <ziy@...dia.com>,
 Baolin Wang <baolin.wang@...ux.alibaba.com>,
 "Liam R . Howlett" <Liam.Howlett@...cle.com>, Nico Pache
 <npache@...hat.com>, Ryan Roberts <ryan.roberts@....com>,
 Dev Jain <dev.jain@....com>, Barry Song <baohua@...nel.org>,
 Jann Horn <jannh@...gle.com>, linux-mm@...ck.org,
 linux-kernel@...r.kernel.org, Lance Yang <ioworker0@...il.com>,
 SeongJae Park <sj@...nel.org>, Suren Baghdasaryan <surenb@...gle.com>
Subject: Re: [PATCH v2 5/5] mm/madvise: eliminate very confusing manipulation
 of prev VMA

On 6/24/25 15:16, Lorenzo Stoakes wrote:
> Hi Andrew,
> 
> stress-ng picked up a very subtle bug here. Please apply this fix-patch to
> correct it!
> 
> Cheers, Lorenzo
> 
> ----8<----
> From a04de12e1deb50e708392b0e716612f26c6b386a Mon Sep 17 00:00:00 2001
> From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
> Date: Tue, 24 Jun 2025 14:14:19 +0100
> Subject: [PATCH] mm/madvise: fix very subtle bug
> 
> With thanks to stress-ng --madvise :)
> 
> vma may have been updated (in the modify call in madvise_update_vma()), so
> we can't assign prev = vma, we must first reassign vma to
> madv_behavior->vma to account for this, before setting prev = vma.

So glad we eliminated very confusing manipulation of prev VMA :) sigh...

LGTM (not worth much it seems...)

> ---
>  mm/madvise.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/madvise.c b/mm/madvise.c
> index 4491bf080f55..c467ee42596f 100644
> --- a/mm/madvise.c
> +++ b/mm/madvise.c
> @@ -1665,8 +1665,8 @@ int madvise_walk_vmas(struct madvise_behavior *madv_behavior)
>  			vma = NULL;
>  			madv_behavior->lock_dropped = false;
>  		} else {
> -			prev = vma;
>  			vma = madv_behavior->vma;
> +			prev = vma;
>  		}
> 
>  		if (vma && range->end < vma->vm_end)
> --
> 2.50.0