linux-kernel - Re: [PATCH] mm/mmap_lock: Reset maple state on lock_vma_under

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251112122446.e1f2c037550dc591a4d6b307@linux-foundation.org>
Date: Wed, 12 Nov 2025 12:24:46 -0800
From: Andrew Morton <akpm@...ux-foundation.org>
To: "Liam R. Howlett" <Liam.Howlett@...cle.com>
Cc: Suren Baghdasaryan <surenb@...gle.com>, Vlastimil Babka
 <vbabka@...e.cz>, linux-mm@...ck.org, linux-kernel@...r.kernel.org, Lorenzo
 Stoakes <lorenzo.stoakes@...cle.com>, Shakeel Butt
 <shakeel.butt@...ux.dev>, Jann Horn <jannh@...gle.com>,
 stable@...r.kernel.org,
 syzbot+131f9eb2b5807573275c@...kaller.appspotmail.com
Subject: Re: [PATCH] mm/mmap_lock: Reset maple state on lock_vma_under_rcu()
 retry

On Tue, 11 Nov 2025 21:18:19 -0500 "Liam R. Howlett" <Liam.Howlett@...cle.com> wrote:

> > Prior to commit 0b16f8bed19c ("mm: change vma_start_read() to drop RCU
> > lock on failure"), vma_start_read() would drop rcu read lock and
> > return NULL, so the retry would not have happened. However, now that
> > vma_start_read() drops rcu read lock on failure followed by a retry,
> > we may end up using a freed maple tree node cached in the maple state.
> 
> Yes, sounds good.
> 
> Andrew, can you make this change and also drop Cc stable tag?

Done.

> This needs to be a hot fix, as Vlastimil said earlier.

Yup.