From: Andrew Morton <akpm@linux-foundation.org>
To: Hajime Tazaki <thehajime@gmail.com>
Cc: liam@infradead.org, ljs@kernel.org, vbabka@kernel.org,
jannh@google.com, pfalcato@suse.de, linux-mm@kvack.org,
geert@linux-m68k.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/2] mm: nommu: fix the error path when vma_iter_prealloc() fails
Date: Tue, 7 Jul 2026 17:39:10 -0700 [thread overview]
Message-ID: <20260707173910.928c74a7e4dc8a1fdfddae3d@linux-foundation.org> (raw)
In-Reply-To: <20260707235137.498738-1-thehajime@gmail.com>
On Wed, 8 Jul 2026 08:51:36 +0900 Hajime Tazaki <thehajime@gmail.com> wrote:
> When vma_iter_prealloc() fails in do_mmap(), it jumps to error_just_free
> without updating ret to -ENOMEM, meaning do_mmap() will return 0 on
> failure.
>
> Additionally, this error path unconditionally frees the region struct.
> Since the region was already added to the global nommu_region_tree via
> add_nommu_region(), leaving it makes a potential dangling pointer in
> the tree and may cause a use-after-free on the next tree walk.
>
> This commit fixes those issues by introducing new jump
> label, error_vma_iter_prealloc, to correctly handle the error case of
> vma_iter_prealloc(), and move the region updates after the place that
> the allocation is finished.
>
> Those issues are discovered by Sashiko, linked below.
Thanks. Now I'm wondering if you regret opening this can of worms ;)
https://sashiko.dev/#/patchset/20260707235137.498738-1-thehajime@gmail.com
afaict, all these issues pertain to failures from vma_iter_prealloc().
next prev parent reply other threads:[~2026-07-08 0:39 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-07 23:51 [PATCH 1/2] mm: nommu: fix the error path when vma_iter_prealloc() fails Hajime Tazaki
2026-07-07 23:51 ` [PATCH 2/2] mm: nommu: fix error handling on vma_iter_prealloc() failure Hajime Tazaki
2026-07-08 0:39 ` Andrew Morton [this message]
2026-07-08 1:13 ` [PATCH 1/2] mm: nommu: fix the error path when vma_iter_prealloc() fails Hajime Tazaki
2026-07-08 13:18 ` Hajime Tazaki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260707173910.928c74a7e4dc8a1fdfddae3d@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=geert@linux-m68k.org \
--cc=jannh@google.com \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=pfalcato@suse.de \
--cc=thehajime@gmail.com \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.