linux-kernel - Re: [PATCH v2 00/10] Remove XA_ZERO from error recovery of dup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260115110153.bbbce63a68df01d8cd4e6eaa@linux-foundation.org>
Date: Thu, 15 Jan 2026 11:01:53 -0800
From: Andrew Morton <akpm@...ux-foundation.org>
To: "Liam R. Howlett" <Liam.Howlett@...cle.com>
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org, Suren Baghdasaryan
 <surenb@...gle.com>, Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, Pedro
 Falcato <pfalcato@...e.de>, David Hildenbrand <david@...hat.com>, Vlastimil
 Babka <vbabka@...e.cz>, Michal Hocko <mhocko@...e.com>, Jann Horn
 <jannh@...gle.com>, shikemeng@...weicloud.com, kasong@...cent.com,
 nphamcs@...il.com, bhe@...hat.com, baohua@...nel.org, chrisl@...nel.org,
 Matthew Wilcox <willy@...radead.org>
Subject: Re: [PATCH v2 00/10] Remove XA_ZERO from error recovery of
 dup_mmap()

On Thu, 15 Jan 2026 13:27:10 -0500 "Liam R. Howlett" <Liam.Howlett@...cle.com> wrote:

> It is possible that the dup_mmap() call fails on allocating or setting
> up a vma after the maple tree of the oldmm is copied.  Today, that
> failure point is marked by inserting an XA_ZERO entry over the failure
> point so that the exact location does not need to be communicated
> through to exit_mmap().
> 
> However, a race exists in the tear down process because the dup_mmap()
> drops the mmap lock before exit_mmap() can remove the partially set up
> vma tree.  This means that other tasks may get to the mm tree and find
> the invalid vma pointer (since it's an XA_ZERO entry), even though the
> mm is marked as MMF_OOM_SKIP and MMF_UNSTABLE.
> 
> To remove the race fully, the tree must be cleaned up before dropping
> the lock.  This is accomplished by extracting the vma cleanup in
> exit_mmap() and changing the required functions to pass through the vma
> search limit.  Any other tree modifications would require extra cycles
> which should be spent on freeing memory.
> 
> This does run the risk of increasing the possibility of finding no vmas
> (which is already possible!) in code that isn't careful.
> 
> The final four patches are to address the excessive argument lists being
> passed between the functions.  Using the struct unmap_desc also allows
> some special-case code to be removed in favour of the struct setup
> differences.

Thanks, all.  I quietly added this series to mm.git's mm-new branch. 
All being well I shall move it into mm.git's mm-unstable branch (and
hence into linux-next) a few days from now.