linux-kernel - Re: [PATCH v3 00/11] Remove XA_ZERO from error recovery of dup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ddyvvndzveegw47wpvlqdushau2qqbue5fwfsylanntoi3apyz@l7ah6cnmrpnp>
Date: Wed, 21 Jan 2026 14:34:45 -0500
From: "Liam R. Howlett" <Liam.Howlett@...cle.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Suren Baghdasaryan <surenb@...gle.com>,
        Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
        Pedro Falcato <pfalcato@...e.de>, David Hildenbrand <david@...hat.com>,
        Vlastimil Babka <vbabka@...e.cz>, Michal Hocko <mhocko@...e.com>,
        Jann Horn <jannh@...gle.com>, shikemeng@...weicloud.com,
        kasong@...cent.com, nphamcs@...il.com, bhe@...hat.com,
        baohua@...nel.org, chrisl@...nel.org,
        Matthew Wilcox <willy@...radead.org>
Subject: Re: [PATCH v3 00/11]  Remove XA_ZERO from error recovery of
 dup_mmap()

* Andrew Morton <akpm@...ux-foundation.org> [260121 13:59]:
> On Wed, 21 Jan 2026 11:49:35 -0500 "Liam R. Howlett" <Liam.Howlett@...cle.com> wrote:
> 
> > It is possible that the dup_mmap() call fails on allocating or setting
> > up a vma after the maple tree of the oldmm is copied.  Today, that
> > failure point is marked by inserting an XA_ZERO entry over the failure
> > point so that the exact location does not need to be communicated
> > through to exit_mmap().
> > 
> > However, a race exists in the tear down process because the dup_mmap()
> > drops the mmap lock before exit_mmap() can remove the partially set up
> > vma tree.  This means that other tasks may get to the mm tree and find
> > the invalid vma pointer (since it's an XA_ZERO entry), even though the
> > mm is marked as MMF_OOM_SKIP and MMF_UNSTABLE.
> > 
> > To remove the race fully, the tree must be cleaned up before dropping
> > the lock.  This is accomplished by extracting the vma cleanup in
> > exit_mmap() and changing the required functions to pass through the vma
> > search limit.  Any other tree modifications would require extra cycles
> > which should be spent on freeing memory.
> 
> I've updated mm-unstable to this version. thanks.
> 
> > Changes since v2:
> > - Fixed header issue - Thanks Lorenzo & SeongJae
> 
> According to my thing, this is how v3 altered mm.git:
> 
> 
> --- a/include/linux/pgtable.h~b
> +++ a/include/linux/pgtable.h
> @@ -1660,6 +1660,7 @@ void arch_sync_kernel_mappings(unsigned
>  #define FIRST_USER_ADDRESS	0UL
>  #endif
>  
> +
>  /*
>   * No-op macros that just return the current protection value. Defined here
>   * because these macros can be used even if CONFIG_MMU is not defined.
> _
> 
> 
> So I assume you incorporated SeongJae's fix as-is.

Pretty close.

I messed up the whitespace, which is probably the delta.  I also added
the header change to this patch (from Lorenzo), but I probably should
have put that in the later patch (like SJ said in his response to my
patch).  I don't think there's any harm either way.

Thanks,
Liam