linux-kernel - Forwarded: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <691d5adf.a70a0220.d98e3.0008.GAE@google.com>
Date: Tue, 18 Nov 2025 21:51:27 -0800
From: syzbot <syzbot+a72c325b042aae6403c7@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close
 for split VMAs

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel
calls vm_ops->close on each portion. For trace buffer mappings, this
results in ring_buffer_unmap() being called multiple times while
ring_buffer_map() was only called once.

This causes ring_buffer_unmap() to return -ENODEV on subsequent calls
because user_mapped is already 0, triggering a WARN_ON.

Fix this by handling -ENODEV gracefully in tracing_buffers_mmap_close().
When ring_buffer_unmap() returns -ENODEV, it means this VMA was a split
portion that doesn't hold a reference, so simply return without calling
put_snapshot_map().

Closes: https://syzkaller.appspot.com/bug?extid=a72c325b042aae6403c7
Reported-by: syzbot+a72c325b042aae6403c7@...kaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 kernel/trace/trace.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index d1e527cf2aae..fe593dd2c387 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8776,8 +8776,17 @@ static void tracing_buffers_mmap_close(struct vm_area_struct *vma)
 {
 	struct ftrace_buffer_info *info = vma->vm_file->private_data;
 	struct trace_iterator *iter = &info->iter;
+	int ret;

-	WARN_ON(ring_buffer_unmap(iter->array_buffer->buffer, iter->cpu_file));
+	ret = ring_buffer_unmap(iter->array_buffer->buffer, iter->cpu_file);
+	if (ret == -ENODEV) {
+		/*
+		 * This VMA was split from the original mapping. Since
+		 * ring buffer mappings do not support partial mappings,
+		 * the split VMA does not hold a reference.
+		 */
+		return;
+	}
 	put_snapshot_map(iter->tr);
 }

-- 
2.43.0