linux-kernel - Re: [PATCH 3/4] mm: synchronize saved_auxv access with arg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEWA0a6x+RfcBpOrcJuWaFcZCPAbBV2uDWHfQbaCMv8vBHeZEg@mail.gmail.com>
Date: Tue, 10 Feb 2026 17:08:46 -0800
From: Andrei Vagin <avagin@...gle.com>
To: Alexander Mikhalitsyn <alexander@...alicyn.com>
Cc: Kees Cook <kees@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, 
	Cyrill Gorcunov <gorcunov@...il.com>, Mike Rapoport <rppt@...nel.org>, linux-kernel@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org, linux-mm@...ck.org, criu@...ts.linux.dev, 
	Chen Ridong <chenridong@...wei.com>, Christian Brauner <brauner@...nel.org>, 
	David Hildenbrand <david@...nel.org>, Eric Biederman <ebiederm@...ssion.com>, 
	Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, Michal Koutny <mkoutny@...e.com>
Subject: Re: [PATCH 3/4] mm: synchronize saved_auxv access with arg_lock

On Tue, Feb 10, 2026 at 12:36 PM Alexander Mikhalitsyn
<alexander@...alicyn.com> wrote:
>

....

> >  static const struct file_operations proc_auxv_operations = {
> > diff --git a/kernel/fork.c b/kernel/fork.c
> > index 0091315643de..c0a3dd94df22 100644
> > --- a/kernel/fork.c
> > +++ b/kernel/fork.c
> > @@ -1104,8 +1104,13 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
> >                 __mm_flags_overwrite_word(mm, mmf_init_legacy_flags(flags));
> >                 mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK;
> >
> > -               if (mm_flags_test(MMF_USER_HWCAP, current->mm))
> > +               if (mm_flags_test(MMF_USER_HWCAP, current->mm)) {
> > +                       spin_lock(&current->mm->arg_lock);
> >                         mm_flags_set(MMF_USER_HWCAP, mm);
> > +                       memcpy(mm->saved_auxv, current->mm->saved_auxv,
> > +                              sizeof(mm->saved_auxv));
>
> nit: I was looking for this memcpy(mm->saved_auxv,
> current->mm->saved_auxv, sizeof(mm->saved_auxv)) while reviewing
> a previous patch. Shouldn't it be there?
>

No, it should not. dup_mm copies the contents of the old mm to the new one
immediately after allocation, but it does so without holding any locks.

Thanks,
Andrei