Re: [PATCH bpf-next v4] bpf: Fix use-after-free on mm_struct in bpf_find_vma()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] bpf_find_vma() traverses the VMA tree of an external mm_struct (from a foreign task) without checking check_stable_address_space(mm).
--

commit f5292fedb813b822dd4346a72223c8122c445d8e
Author: Sanghyun Park <sanghyun.park.cnu@gmail.com>

bpf: Fix use-after-free on mm_struct in bpf_find_vma()

This commit prevents a use-after-free on the mm_struct of foreign tasks by
pinning it under task->alloc_lock and releasing it with mmput_async(). It
also uses spin_trylock() to ensure the BPF context does not block.

> diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
> index e791ae065c39b..77f90b887bf1e 100644
> --- a/kernel/bpf/task_iter.c
> +++ b/kernel/bpf/task_iter.c

[ ... ]

> @@ -765,14 +775,38 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,

[ ... ]

>  	irq_work_busy = bpf_mmap_unlock_get_irq_work(&work);
>  
> -	if (irq_work_busy || !mmap_read_trylock(mm))
> -		return -EBUSY;
> +	if (irq_work_busy || !mmap_read_trylock(mm)) {
> +		ret = -EBUSY;
> +		goto out;
> +	}
>  
>  	vma = find_vma(mm, start);
>  
>  	if (vma && vma->vm_start <= start && vma->vm_end > start) {

[Severity: High]
This is a pre-existing issue, but should bpf_find_vma() call
check_stable_address_space() on the mm_struct before calling find_vma()?

When inspecting a foreign task, the mm_struct could be flagged with
MMF_UNSTABLE if it was subject to an OOM reap or a dup_mmap() failure. In
this state, the maple tree can contain XA_ZERO_ENTRY markers.

If find_vma() returns one of these markers, does the subsequent check
using vma->vm_start dereference an internal integer value and cause a
kernel panic?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610024637.343364-1-sanghyun.park.cnu@gmail.com?part=1