linux-kernel - Re: [PATCH next] mm/maps: move kmalloc() call location in do_procmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJuCfpHi_Stt4H1DFSgjEJ=pduYbR3keZqAozLcxBReHjjHiNw@mail.gmail.com>
Date: Thu, 3 Jul 2025 23:11:47 -0700
From: Suren Baghdasaryan <surenb@...gle.com>
To: David Hildenbrand <david@...hat.com>
Cc: Jeongjun Park <aha310510@...il.com>, akpm@...ux-foundation.org, andrii@...nel.org, 
	osalvador@...e.de, Liam.Howlett@...cle.com, christophe.leroy@...roup.eu, 
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	syzbot+6246a83e7bd9f8a3e239@...kaller.appspotmail.com
Subject: Re: [PATCH next] mm/maps: move kmalloc() call location in
 do_procmap_query() out of RCU critical section

On Wed, Jul 2, 2025 at 4:34 PM Suren Baghdasaryan <surenb@...gle.com> wrote:
>
> On Wed, Jul 2, 2025 at 7:44 AM David Hildenbrand <david@...hat.com> wrote:
> >
> > On 02.07.25 15:53, Jeongjun Park wrote:
> > > In do_procmap_query(), we are allocating name_buf as much as name_buf_sz
> > > with kmalloc().
> > >
> > > However, due to the previous commit eff061546ca5
> > > ("mm/maps: execute PROCMAP_QUERY ioctl under per-vma locks"),
> > > the location of kmalloc() is located inside the RCU critical section.
> > >
> > > This causes might_sleep_if() to be called inside the RCU critical section,
> > > so we need to move the call location of kmalloc() outside the RCU critical
> > > section to prevent this.
> > >
> > > Reported-by: syzbot+6246a83e7bd9f8a3e239@...kaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=6246a83e7bd9f8a3e239
> > > Fixes: eff061546ca5 ("mm/maps: execute PROCMAP_QUERY ioctl under per-vma locks")
> >
> > That commit is not upstream yet (and the commit id is not stable), so it
> > should be squashed into the problematic commit.
> >
> > As a side note: the patch subject of this and the original patch should
> > start with "fs/proc/task_mmu", not "mm/maps".
>
> Thanks for the fix Jeongjun and thanks for the note David.
> I'm preparing the next version of my patchset and there is a much
> simpler fix for this issue which I'll implement there. Planning to
> post it tomorrow.

v6 of my patchset is posted at
https://lore.kernel.org/all/20250704060727.724817-1-surenb@google.com/
I reworked the last patch to address this issue by narrowing down the
rcu read section to query_vma_find_by_addr() only. That should fix the
original issue.

> Thanks,
> Suren.
>
> >
> > --
> > Cheers,
> >
> > David / dhildenb
> >