From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk2-f13.google.com (mail-qk2-f13.google.com [74.125.230.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2A36411A07 for ; Thu, 24 Sep 2026 17:17:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.205 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790270254; cv=none; b=Z8yYmcUvZZFt/ZEP/zSFOy6gBbQBLJb4A6lvoXs12+1Fcd2Qz11UF1DCluRlDkVW9i0y+J+CL0P7appeHQugu9BqMN8G71fVuOgflbXm1D1JIcYoF4MKE2HmU3n0mCKrDr+Y2V5tmG59+rHITaIyt4gFdGyJ1uu1w1k085E+LjM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790270254; c=relaxed/simple; bh=N9G2xDWLJkhjpVHjPudlC9eB56JQvy0Q3UFpvQ70GnM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=kW/jTB9MLNEwbYTxidsqZaovFyr0CwnL61kvTRWs/q/JuVy+jMjaJs68XS+F2qOvos5GasjlhGMtnpfQDH0QJNFQfXTRM3CTKzR5AEnMB9d0D/kr5vsJDF6B6t8ucX2WR+OXdlmNOOLkss1Hf/EvaeKwWItBn+CFKRb+Dxdny5c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=gourry.net; spf=pass smtp.mailfrom=gourry.net; dkim=pass (2048-bit key) header.d=gourry.net header.i=@gourry.net header.b=tprV5yBU; arc=none smtp.client-ip=74.125.230.205 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=gourry.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gourry.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gourry.net header.i=@gourry.net header.b="tprV5yBU" Received: by mail-qk2-f13.google.com with SMTP id d75a77b69052e-530e28a62abso911281cf.1 for ; Thu, 24 Sep 2026 10:17:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gourry.net; s=google; t=1790270251; x=1790875051; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=feTLx7y3sxZ57LB+c+M8YbdddVhljMzyHzPRAu6TpA4=; b=tprV5yBUII/qRzLyqKPdJDICtcHMIXdxXt3R1PhRppTAqbBmNEs7Uqtgc/IauT7bas 6q+btZ6riiYDfPxMNxJ9LlKIzVy4E/rMZS8FF2kWFWhC/RTZ0m/dLDIeIJEc6DmgUeKW rRe5l+D4Gb5EgFoh0bNUVpRhgcRfueygz54BCmywUEAofeJDIrYo8R8bOOlnVVhbm8Xx 8y1PvkD+okpXc2BYxVcdIyuBwaEwabsdPE+xSDWc5coaNizNqVaWAFRlWZ+CHrBLXEHc +ibea7n8Gc0GPrQRe/RTIUKy7LATsQy5mAZvm52IfaGHNyUnZEVBqjo1InS2m+tWjzj5 xc4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790270251; x=1790875051; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=feTLx7y3sxZ57LB+c+M8YbdddVhljMzyHzPRAu6TpA4=; b=F9rEk6Gs/vs05n/ty8M27PudNECLp0CJ60DBkgMSK7JlcNrsQYFb6qXlFFZcXdI2zJ 89ASEO4f1aFUs+2zBv8tD68W3uz32d3WKOtolK4p8mK5mSZFbJjNPeHaUAcyN0zK4zdy TvFLpzlfDxKuCBOwaBQ/BqTvizdmaNxz2SjoUyUNXV6Q0u/W2anHy6FQDnA8MzOVoYpl AgNB2b7tY4UAcZ3NfNaFiySr0crCbwsRPeu0gTAcH7zAS9JKZmx/MQ2KmSS9TLtTIJ2l XSBVvyGXHC3NpAM8sw2ydNIHLWzmjxvGsbrC2qSgI9nk6XOTYcnOws0zokIrzs4FPkfb 9nLQ== X-Forwarded-Encrypted: i=1; AKwUvBzMZtjTWO7HhbkiPY/kbE9vf8Bji7Qgk7pnjDy7MQQKPeoAJ7DvOz0JzbSAagXTAHinzexXWZIMbrjDow==@vger.kernel.org X-Gm-Message-State: AFuF++ka0B1PQItEsvHELeW0idTI99SEet6JM89d+Uxt62qLs5Q/omyX k48GfExoYwJwLgWrMI8+qHyy2PC31e8HBRc7qbSMKVgGX4PYzskKkD/R7tE87b6+V0I= X-Gm-Gg: AYBFou1yVdmMwPJZIS8kGhGq94aAU6dqHq8XJalJM1CR1ulQt4zrnFF0nyKrvHOCsb3 rgJDnH7wm/sraNeo0cTw8FYeymzCBTLaEaLYcT1fOXkJPkDiHSlXyxz0ywpG8cqRMvmYxhwLkEB hqAScrzay9eH/EP2BDWZ37qh8mt9xvvCpIebOuWtGXLAhJ8464XvtY8KzKW22llndIAmAWzHATR 9VgLO6VUw4FQOcQAisYwLYh58DBcRdpWmJCTx0mfpjllq1iOuvZFWlFMDXNEiNL/E3sNdqDXea8 wuGyest05W1UFiWjv1Mn+DJeayimN0yreR+TRcL13TjIG/cdSios9dxW8xg0jvoHsSk6HzKcdZw P7nc0doVkQur+cObQipTMr2IuvQW/0fDAaA0lvTIaSiQAHJsLnBtMPz1wrLuGtEvDaIT8poACj9 SlTQRG3iLd25K/qglfT9vK+vgl1J+RY85h4dMf2uPXCrCR6OeshOh+H9D0zrJ4RBbrMbELsC5tJ LqpniwXbQXu/6jDZszwdJhX0RxrdrRwkbwjmHgqFCUq28p8fLB2jtM= X-Received: by 2002:a05:622a:2b05:b0:530:42e4:f001 with SMTP id d75a77b69052e-532feb3025amr31555731cf.46.1790270250746; Thu, 24 Sep 2026 10:17:30 -0700 (PDT) Received: from gourry-fedora-PF4VCD3F (pool-173-79-60-52.washdc.fios.verizon.net. [173.79.60.52]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-532f8b7174asm25743881cf.14.2026.09.24.10.17.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2026 10:17:30 -0700 (PDT) Date: Thu, 24 Sep 2026 13:17:28 -0400 From: Gregory Price To: "Lorenzo Stoakes (ARM)" Cc: Andrew Morton , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-usb@vger.kernel.org, linux-rdma@vger.kernel.org, selinux@vger.kernel.org, linux-sound@vger.kernel.org, bpf@vger.kernel.org, linux-scsi@vger.kernel.org, linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-trace-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux-arch@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, kvm@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, sparclinux@vger.kernel.org, fuse-devel@lists.linux.dev Subject: Re: [PATCH v3 04/40] mm: consistently validate VMA state after mmap[_prepare] hooks Message-ID: References: <20260917-b4-mmap-prepare-vma-flag-sanify-v3-0-4583d8a23bca@kernel.org> <20260917-b4-mmap-prepare-vma-flag-sanify-v3-4-4583d8a23bca@kernel.org> Precedence: bulk X-Mailing-List: linux-fbdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260917-b4-mmap-prepare-vma-flag-sanify-v3-4-4583d8a23bca@kernel.org> On Thu, Sep 17, 2026 at 05:22:13PM +0100, Lorenzo Stoakes (ARM) wrote: > static inline int mmap_file(struct file *file, struct vm_area_struct *vma) > { ... > + err = mmap_hook_validate(prev_start, prev_end, &prev_flags, vma); > + if (unlikely(err)) { > + vma->vm_start = prev_start; > + vma->vm_end = prev_end; > + vma_close(vma); > } > + > + return err; > } > I indepdeantly validated the sashiko report on this chunk. Seems like close() should be deferred until after __map_new_file_vma() calls unmap_region(). suggested fix is to drop vma_close() from mmap_file() and update the cleanup in __mmap_new_file_vma() if (error) { UNMAP_STATE(unmap, vmi, vma, vma->vm_start, vma->vm_end, map->prev, map->next); vma_iter_set(vmi, vma->vm_end); unmap_region(&unmap); /* Release driver state only after its mappings are gone. */ vma_close(vma); if (map_same_file(map)) fput(map->vm_file); vma->vm_file = NULL; return error; } Example race: Thread A Thread B mmap(MAP_FIXED, address A) driver remap_pfn_range(A, page P) load/store at known address A hardware finds the new present PTE validation fails ->close() frees page P UAF unmap_region() TLB shootdown With that fix Reviewed-by: Gregory Price (Meta) ~Gregory From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6C0BDC9830E for ; Thu, 24 Sep 2026 17:17:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=X3gYuSi/K2SrTT/AddJ9Iu2qZWY9Keq7nXFpCVuR/8k=; b=Dd026yKpHmTYGf op96eahHMSGG0ev/8hD23rsOahKRX80tSnF/+fjCm8WMRRndszzQPCMXbM6YBawU/lK+cNkYG/fbP b72Ssp2fnPb7P3Wweg0Zy67OqvpaBWI5wrf8f4T0TGki7k4IhAWl/mz+T1B5XNGZxQ3hMLhxEnPk8 yR7xguD973ixzpgY05opk0qrNbUviCY5fGI1ERrbVCIJvpE0v/8s47dHNpPLY/itc/oedXS24Z33I qLhiZAfajP5eUd2J7dvpr10q9sDxP1aWUq0dJChujht1sUx0U/FcQHuCbRThgDNQvuq7iVVMD7a+4 D78fciZtYMrngNAxQSZw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x9n4h-0000000BhlD-3b6K; Thu, 24 Sep 2026 17:17:35 +0000 Received: from mail-qk2-x11.google.com ([2607:f8b0:4864:34::11]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x9n4e-0000000Bhj4-0lmR for linux-riscv@lists.infradead.org; Thu, 24 Sep 2026 17:17:34 +0000 Received: by mail-qk2-x11.google.com with SMTP id d75a77b69052e-530e28a62abso911271cf.1 for ; Thu, 24 Sep 2026 10:17:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gourry.net; s=google; t=1790270251; x=1790875051; darn=lists.infradead.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=feTLx7y3sxZ57LB+c+M8YbdddVhljMzyHzPRAu6TpA4=; b=BmjHDWyrME5CR9CubonolQn2zrlZpmmrPGzRSnah23RWKc47TNtOOoSCKbYXrXjIgx lV9SplZYYKe5BCbc2WgYu90B/V6AFF2K9HqVh7Iu70RKk2k46m4r3ryeO7tW97PcOf79 4BsOQ9QOld7e4jfgOkkiF3JvWsr93APmgX1tasX6gTlvOnPpyBfDv7YiVsVrPO+0Oy04 K1BpFMclVJpcWHuEZLBzLuxrP2W5yPJYOJ3+wXz6sfwKbuyg+9Bz1g2T+yRQEK5dKmTG dH/FglN02tRCAAXNwBcBnf1jCn4STjo0Yd6vXmDN9t743dVFcwrqkX9Fp7wSRLBDK083 tXDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790270251; x=1790875051; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=feTLx7y3sxZ57LB+c+M8YbdddVhljMzyHzPRAu6TpA4=; b=0GhPMTdYfdvgghN5Otg0GSKPvUGQOjkObem/CiKDF2MKFMYfIH3YyAz0hQ/cSTYY7W 78PIzGYrEvFYwr7nujMESH8TnQBVRGH3yLA/evxkMkpC14prKeaRpP5RJIZZYYmWgIFW tWCVlmOc8X08lfMavP++atfQMnmcsqZVChPB2V/jPkvvlz/ntE6KxbBYR2HwHmcsy+QG 0Rw1UwM/zZabSxQsnkLZeB1rEoyVfyYkGtwA6nlMAYgnuZF8Po+qrRz/wRTP1Zf8vMEF xU15Yx5S9qQpTyD89UPj3yHvLU7cROfnIhb1fHqMABy20ZJEhd6bobo37II/ExtEVTl2 LrVA== X-Forwarded-Encrypted: i=1; AKwUvBw1qwELL5dobUh+iPBCnLwbkdf4FVIF6ROSZgDIjzrWqsn5OiRd1ngNUQeAcoz41juxdUhHk1iHVm6VQQ==@lists.infradead.org X-Gm-Message-State: AFuF++kHJ28QTCbfTgDkZbP3L9st18X4j2DdyD3JSsZGhOnG5b4+Xdbw 26sSi+UlIGmQEVaGocZ3kddJp63lkFyn8t+Ed+BGlHFXNGjL6pcZ1Qccdnvi6cejxeE= X-Gm-Gg: AYBFou3XygDm5SC0S20bTvHoD6tjvx/bZluGapGuybHiBR9JIO86RvjA2yUwYVb7EsA XxTEmu0J3t1IrHByVb8sEZsdUKpqaSz/M7R8bzXVyFvN/15pnD/AFviO/TajeuhGvf1Ki3anAw1 l7XitsXdjf689MNLQrlu1iGG2jLIj6CC6eyNGjLzuUhhsuSzUYF+HQqkYR7b8Gt04Uo/wgq7vPj 72hppXWoQCfiwA030cf4AMRx7dDiuU2lj2VnPm3/9mtdHWiF2sIDEUHC6VC8bncZJKGpOLbDjrW OZIoe7BS8M9SEYR/pEF8f8S8GbzU3idyFD0ZDCbPKeLfiXRsgaiG//TFBtPjrvPHYDlmAsJrTM4 C8E9w7XzAV555lo2f5nqR2u3H/16nnixQEK/e6Y1hmkwqPrh0avbEJZikjbZEvjLQzWnFXYv0X+ EWyo4HZ9NMNsOnlew7XzlQsXu5DpkcXcxs090rzOgfleL9Yb2fd+nMJ2VCYUninhzL505XHJTHs B0znG2ymKQOyWelwu+Bq+0H800oyyK4Jww/zdJL+oW5ypNyG1sSg5M= X-Received: by 2002:a05:622a:2b05:b0:530:42e4:f001 with SMTP id d75a77b69052e-532feb3025amr31555731cf.46.1790270250746; Thu, 24 Sep 2026 10:17:30 -0700 (PDT) Received: from gourry-fedora-PF4VCD3F (pool-173-79-60-52.washdc.fios.verizon.net. [173.79.60.52]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-532f8b7174asm25743881cf.14.2026.09.24.10.17.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2026 10:17:30 -0700 (PDT) Date: Thu, 24 Sep 2026 13:17:28 -0400 From: Gregory Price To: "Lorenzo Stoakes (ARM)" Cc: Andrew Morton , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-usb@vger.kernel.org, linux-rdma@vger.kernel.org, selinux@vger.kernel.org, linux-sound@vger.kernel.org, bpf@vger.kernel.org, linux-scsi@vger.kernel.org, linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-trace-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux-arch@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, kvm@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, sparclinux@vger.kernel.org, fuse-devel@lists.linux.dev Subject: Re: [PATCH v3 04/40] mm: consistently validate VMA state after mmap[_prepare] hooks Message-ID: References: <20260917-b4-mmap-prepare-vma-flag-sanify-v3-0-4583d8a23bca@kernel.org> <20260917-b4-mmap-prepare-vma-flag-sanify-v3-4-4583d8a23bca@kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20260917-b4-mmap-prepare-vma-flag-sanify-v3-4-4583d8a23bca@kernel.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260924_101732_241306_46FE6227 X-CRM114-Status: GOOD ( 10.38 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org On Thu, Sep 17, 2026 at 05:22:13PM +0100, Lorenzo Stoakes (ARM) wrote: > static inline int mmap_file(struct file *file, struct vm_area_struct *vma) > { ... > + err = mmap_hook_validate(prev_start, prev_end, &prev_flags, vma); > + if (unlikely(err)) { > + vma->vm_start = prev_start; > + vma->vm_end = prev_end; > + vma_close(vma); > } > + > + return err; > } > I indepdeantly validated the sashiko report on this chunk. Seems like close() should be deferred until after __map_new_file_vma() calls unmap_region(). suggested fix is to drop vma_close() from mmap_file() and update the cleanup in __mmap_new_file_vma() if (error) { UNMAP_STATE(unmap, vmi, vma, vma->vm_start, vma->vm_end, map->prev, map->next); vma_iter_set(vmi, vma->vm_end); unmap_region(&unmap); /* Release driver state only after its mappings are gone. */ vma_close(vma); if (map_same_file(map)) fput(map->vm_file); vma->vm_file = NULL; return error; } Example race: Thread A Thread B mmap(MAP_FIXED, address A) driver remap_pfn_range(A, page P) load/store at known address A hardware finds the new present PTE validation fails ->close() frees page P UAF unmap_region() TLB shootdown With that fix Reviewed-by: Gregory Price (Meta) ~Gregory _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 32F67C9830E for ; Thu, 24 Sep 2026 17:17:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=HM1uDVxmddFdbWN8ajFHdD+vpshfrWIYxV4oI8F8qbY=; b=GQygMGSu+LeDVV 8DaXq6eeV+O5aAueSu3NuS+FNnkh2uPVJRwypIPtYNTki81SKa0sRhi0EsN26a+FOuv7LRoQXB/Pf 7n/0qXQMLsUxkU7ggsYw2QEylN7YfLghiyJR/Fz2LDN3QSMuE1gxzWTOLv7gHEnLjBM2zvLz0WCz/ uip+RM1AJ+iIYiZj/0RBQgJghc6Z/r//p3DkwrGNmQs+S/5HXQ322Yo3M2xiJ6XM5MlDxb6YqOGhm i2vpJ0DzXSzxwUYt7dfS1p0FHgC0WsdJQyJ4nNr7/saSdNmYt+xBSsUdNtJw37rcq1lA1qnBwIZnt Ch61HzwimgHOxhiDgdIQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x9n4g-0000000BhkG-2SfL; Thu, 24 Sep 2026 17:17:34 +0000 Received: from mail-qk2-x11.google.com ([2607:f8b0:4864:34::11]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x9n4e-0000000Bhj6-0m8L for kvm-riscv@lists.infradead.org; Thu, 24 Sep 2026 17:17:33 +0000 Received: by mail-qk2-x11.google.com with SMTP id d75a77b69052e-52fb76bcb1eso559541cf.3 for ; Thu, 24 Sep 2026 10:17:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gourry.net; s=google; t=1790270251; x=1790875051; darn=lists.infradead.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=feTLx7y3sxZ57LB+c+M8YbdddVhljMzyHzPRAu6TpA4=; b=BmjHDWyrME5CR9CubonolQn2zrlZpmmrPGzRSnah23RWKc47TNtOOoSCKbYXrXjIgx lV9SplZYYKe5BCbc2WgYu90B/V6AFF2K9HqVh7Iu70RKk2k46m4r3ryeO7tW97PcOf79 4BsOQ9QOld7e4jfgOkkiF3JvWsr93APmgX1tasX6gTlvOnPpyBfDv7YiVsVrPO+0Oy04 K1BpFMclVJpcWHuEZLBzLuxrP2W5yPJYOJ3+wXz6sfwKbuyg+9Bz1g2T+yRQEK5dKmTG dH/FglN02tRCAAXNwBcBnf1jCn4STjo0Yd6vXmDN9t743dVFcwrqkX9Fp7wSRLBDK083 tXDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790270251; x=1790875051; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=feTLx7y3sxZ57LB+c+M8YbdddVhljMzyHzPRAu6TpA4=; b=tccDkEAd3rGK8IUxhhf/1bqX4uNYeW/Qkzw8k3jlu3rY3Ca52pKsL2XQmalIXlB20q QczaFjq+ruKFsJDFBhMlqX1El0iKw5OfkjYN/MU/5s1QFEvDu88+zI7Eign/38A1zY0k hwx4mw/KfDO/qhkT1q0E2GaPAYvg7F1BrccWka+mm4XX4QMzkivRYZ0btZt3/FV2O+P6 BkxsqvkGLEEycpL/y86c99R/yQcy2mkg0wq6nxTo/ATayktWiaTSK0LUV8ArFjYSFTnW 5utX3FTjaeiVcuWOdiokPM/uyFwV1HP5Wlzdua7bie3VbxPFCYDfOQrcOyJ6HAnCmaxE iRDg== X-Forwarded-Encrypted: i=1; AKwUvBx47gjMf/shVVNYh16yJKoF6WWeYM1l4AcPR7TCCanKulTPM1OoaizHWjA9t1Qc1v3YpzSSIOMGDmQ=@lists.infradead.org X-Gm-Message-State: AFuF++nALQS5a8PPCZYQo12D9LuDhJbppg8BsoMGlCGaww6kucrKFqc1 /wZFktm8f36y9S4bYLNzX37lRjkPwgH3nQufcn0/oY152+Imnqe4+X/tWUFZ+3o88nQ= X-Gm-Gg: AYBFou2z24OSaAaPKpSql4CkDe3+MLxbgcx5RtRYjYe8zZMoS/Z63+ZP/rckmeGJKAY FsTjnbK8QTD44uXSKs1l3YIuN1IWyvhixe2dlAussn65dKozKRR4PmKeYSHhV2ydVx/84HzEKJz cSw0w4NowhQyw6yAL8gGYkCaxMr6NhS/YiPBqA9kfLO5o1SUcgxT5EvsylOaNnJ4WDKlFacczBf 6kHtP6J/VKiJv1IBB8KiBlE6I6hXUYirai3PbnCsul/7ysuHfT05ItFpyHemSSi+KWs4t5TAVGD FofsGCuf04aMOzNSpUV7Amdtj+BMb2veO3RameHHmHYLDHODiIXPf5sQBWds9+cZZwDJ1WXQayX iW3I1boPL/pDq8A0ble5EQ6UExBXWEsjHJ7SLppdTYZCBhE2ut44cmuCYkmIO/QDH9yN/fR0CiP Xs94fZVAwUte/x/hI0Uf7kEPdmSJuSfEzva4sjOh2qVOui55yDWnPEXMFImv58p4WW1jBIMdhPa NAXp3E/eV8eWtXCkqxvRmEH/Nu2GN6XKJlVcAdnR7Znar9E1ggxwJs= X-Received: by 2002:a05:622a:2b05:b0:530:42e4:f001 with SMTP id d75a77b69052e-532feb3025amr31555731cf.46.1790270250746; Thu, 24 Sep 2026 10:17:30 -0700 (PDT) Received: from gourry-fedora-PF4VCD3F (pool-173-79-60-52.washdc.fios.verizon.net. [173.79.60.52]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-532f8b7174asm25743881cf.14.2026.09.24.10.17.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2026 10:17:30 -0700 (PDT) Date: Thu, 24 Sep 2026 13:17:28 -0400 From: Gregory Price To: "Lorenzo Stoakes (ARM)" Cc: Andrew Morton , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-usb@vger.kernel.org, linux-rdma@vger.kernel.org, selinux@vger.kernel.org, linux-sound@vger.kernel.org, bpf@vger.kernel.org, linux-scsi@vger.kernel.org, linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-trace-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux-arch@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, kvm@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, sparclinux@vger.kernel.org, fuse-devel@lists.linux.dev Subject: Re: [PATCH v3 04/40] mm: consistently validate VMA state after mmap[_prepare] hooks Message-ID: References: <20260917-b4-mmap-prepare-vma-flag-sanify-v3-0-4583d8a23bca@kernel.org> <20260917-b4-mmap-prepare-vma-flag-sanify-v3-4-4583d8a23bca@kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20260917-b4-mmap-prepare-vma-flag-sanify-v3-4-4583d8a23bca@kernel.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260924_101732_234384_DDDF238F X-CRM114-Status: GOOD ( 10.38 ) X-BeenThere: kvm-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "kvm-riscv" Errors-To: kvm-riscv-bounces+kvm-riscv=archiver.kernel.org@lists.infradead.org On Thu, Sep 17, 2026 at 05:22:13PM +0100, Lorenzo Stoakes (ARM) wrote: > static inline int mmap_file(struct file *file, struct vm_area_struct *vma) > { ... > + err = mmap_hook_validate(prev_start, prev_end, &prev_flags, vma); > + if (unlikely(err)) { > + vma->vm_start = prev_start; > + vma->vm_end = prev_end; > + vma_close(vma); > } > + > + return err; > } > I indepdeantly validated the sashiko report on this chunk. Seems like close() should be deferred until after __map_new_file_vma() calls unmap_region(). suggested fix is to drop vma_close() from mmap_file() and update the cleanup in __mmap_new_file_vma() if (error) { UNMAP_STATE(unmap, vmi, vma, vma->vm_start, vma->vm_end, map->prev, map->next); vma_iter_set(vmi, vma->vm_end); unmap_region(&unmap); /* Release driver state only after its mappings are gone. */ vma_close(vma); if (map_same_file(map)) fput(map->vm_file); vma->vm_file = NULL; return error; } Example race: Thread A Thread B mmap(MAP_FIXED, address A) driver remap_pfn_range(A, page P) load/store at known address A hardware finds the new present PTE validation fails ->close() frees page P UAF unmap_region() TLB shootdown With that fix Reviewed-by: Gregory Price (Meta) ~Gregory -- kvm-riscv mailing list kvm-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kvm-riscv