[BUG] [PATCH v2 mm-stable] procfs: avoid fetching build ID while holding VMA lock

[Thomas Gleixner <tglx@kernel.org>]

On Thu, Jan 29 2026 at 13:53, Andrii Nakryiko wrote:
>  	/* unlock vma or mmap_lock, and put mm_struct before copying data to user */
>  	query_vma_teardown(&lock_ctx);
>  	mmput(mm);
>  
> +	if (karg.build_id_size) {
> +		__u32 build_id_sz;
> +
> +		if (vm_file)
> +			err = build_id_parse_file(vm_file, build_id_buf, &build_id_sz);
> +		else
> +			err = -ENOENT;
> +		if (err) {
> +			karg.build_id_size = 0;
> +		} else {
> +			if (karg.build_id_size < build_id_sz) {
> +				err = -ENAMETOOLONG;
> +				goto out;

Introduces a double mmput() here.

> +			}
> +			karg.build_id_size = build_id_sz;
> +		}
> +	}
> +
> +	if (vm_file)
> +		fput(vm_file);
> +
>  	if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
>  					       name, karg.vma_name_size)) {
>  		kfree(name_buf);
> @@ -798,6 +808,8 @@ static int do_procmap_query(struct mm_struct *mm, void __user *uarg)
>  out:
>  	query_vma_teardown(&lock_ctx);
>  	mmput(mm);
> +	if (vm_file)
> +		fput(vm_file);
>  	kfree(name_buf);
>  	return err;

See:

        https://lore.kernel.org/all/698aaf3c.050a0220.3b3015.0088.GAE@google.com/T/#u

Thanks

        tglx