linux-kernel - Re: [syzbot ci] Re: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20250925144941.125467b7a7717211f6322482@linux-foundation.org>
Date: Thu, 25 Sep 2025 14:49:41 -0700
From: Andrew Morton <akpm@...ux-foundation.org>
To: syzbot ci <syzbot+ci74a400bb557985f4@...kaller.appspotmail.com>
Cc: david@...hat.com, kartikey406@...il.com, linux-kernel@...r.kernel.org,
 linux-mm@...ck.org, muchun.song@...ux.dev, osalvador@...e.de,
 syzbot@...kaller.appspotmail.com, syzbot@...ts.linux.dev,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot ci] Re: hugetlbfs: skip VMAs without shareable locks in
 hugetlb_vmdelete_list

On Thu, 25 Sep 2025 14:06:49 -0700 syzbot ci <syzbot+ci74a400bb557985f4@...kaller.appspotmail.com> wrote:

> syzbot ci has tested the following series
> 
> [v1] hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list
> https://lore.kernel.org/all/20250925144934.150299-1-kartikey406@gmail.com
> * [PATCH] hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list
> 
> and found the following issue:
> WARNING: lock held when returning to user space in hugetlb_vmdelete_list
> 
> Full report is available here:
> https://ci.syzbot.org/series/7d3a090c-ec8f-4d0c-8f7b-8797e63f1fde
> 
> ***
> 
> WARNING: lock held when returning to user space in hugetlb_vmdelete_list
> 
> tree:      torvalds
> URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux
> base:      07e27ad16399afcd693be20211b0dfae63e0615f
> arch:      amd64
> compiler:  Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> config:    https://ci.syzbot.org/builds/06671e7c-eebd-4d11-9f0d-d9dae5637c0a/config
> C repro:   https://ci.syzbot.org/findings/75fcdb87-67fc-45ee-a70d-3064e8c1126c/c_repro
> syz repro: https://ci.syzbot.org/findings/75fcdb87-67fc-45ee-a70d-3064e8c1126c/syz_repro
> 
> ================================================
> WARNING: lock held when returning to user space!
> syzkaller #0 Not tainted

um yes.  Presumably something like the below is needed.

I'm wondering how this passed runtime testing?

If resending, please let's add a comment telling readers why we're
skipping !__vma_shareable_lock vmas.

I'll drop the patch, thanks.

--- a/fs/hugetlbfs/inode.c~hugetlbfs-skip-vmas-without-shareable-locks-in-hugetlb_vmdelete_list-fix
+++ a/fs/hugetlbfs/inode.c
@@ -488,7 +488,7 @@ hugetlb_vmdelete_list(struct rb_root_cac
 		if (!hugetlb_vma_trylock_write(vma))
 			continue;
 		if (!__vma_shareable_lock(vma))
-			continue;
+			goto skip;
 		v_start = vma_offset_start(vma, start);
 		v_end = vma_offset_end(vma, end);
 
@@ -499,6 +499,7 @@ hugetlb_vmdelete_list(struct rb_root_cac
 		 * vmas.  Therefore, lock is not held when calling
 		 * unmap_hugepage_range for private vmas.
 		 */
+skip:
 		hugetlb_vma_unlock_write(vma);
 	}
 }
_