+ mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch added to mm-unstable branch

+ mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch added to mm-unstable branch

[Andrew Morton]

The patch titled
     Subject: mm/vmalloc: read vm_map_ram block regions from the requested offset
has been added to the -mm mm-unstable branch.  Its filename is
     mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch

This patch will later appear in the mm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
Subject: mm/vmalloc: read vm_map_ram block regions from the requested offset
Date: Sat, 17 Oct 2026 19:13:25 -0400

Reading a vm_map_ram() mapping through /proc/kcore returns the wrong
memory for every page except the first page of the first used region in
its vmap block.  read_kcore_iter() calls vread_iter() one page at a time,
so a root user reading a live system with drgn, crash or gdb gets that
first page in place of every later page of the mapping, and in place of
the zeroes of the unused pages after it.  This affects every vm_map_ram()
mapping that fits in a vmap block (up to BITS_PER_LONG pages): erofs and
f2fs decompression buffers, videobuf2 vmalloc/dma-sg buffers, udmabuf
vmaps, fuse readdir pages.  Kernels since v6.3 are affected.

vmap_ram_vread_iter() walks the used regions of the block and, for each
region, zero-fills up to its start and then copies from start +
offset_in_page(addr).  A read starting in a later page of a region
therefore copies the region's first page, and a read starting past the end
of a region still copies from that region.

Skip regions that end at or before addr, and copy from addr itself, i.e. 
use addr - start as the offset into the region.  The region is re - rs
pages long, not re - rs + 1: for_each_set_bitrange() returns [rs, re) with
re the first clear bit.  The extra page is one whose used_map bit is
clear, and vb_free() clears the bits before it unmaps the pages, so a read
racing with vm_unmap_ram() copied the page being freed instead of
zero-filling it.

Tested on x86_64 by queueing a 29-page V4L2_MEMORY_USERPTR buffer on a
vivid capture device, which videobuf2-vmalloc maps with vm_map_ram(), page
i starting with "userptr page i", and reading every page of its vmap block
through /proc/kcore.  Before, all 1024 pages of the block read as page 0. 
After, pages 0..28 read back in order and the rest of the block carries no
tag.  With a second buffer in the same block and a 100-page buffer outside
the block path, reads at unaligned offsets, across page and region
boundaries, into and within the unused part of the block, and of the whole
block return the true contents.  With an msleep() inserted between the
bitmap_clear() and the vunmap_range_noflush() of vb_free(), a read of a
one-page buffer being unmapped between two mapped ones returns zeroes.

Link: https://lore.kernel.org/20261017231325.796986-1-nickolai@csail.mit.edu
Fixes: 06c8994626d1 ("mm/vmalloc.c: allow vread() to read out vm_map_ram areas")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
---

 mm/vmalloc.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/mm/vmalloc.c~mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset
+++ a/mm/vmalloc.c
@@ -4649,7 +4649,7 @@ static size_t vmap_ram_vread_iter(struct
 	struct xarray *xa;
 	unsigned long offset;
 	unsigned int rs, re;
-	size_t remains, n;
+	size_t remains, n, size;
 
 	/*
 	 * If it's area created by vm_map_ram() interface directly, but
@@ -4683,6 +4683,10 @@ static size_t vmap_ram_vread_iter(struct
 			goto finished;
 
 		start = vmap_block_vaddr(vb->va->va_start, rs);
+		size = (re - rs) << PAGE_SHIFT;
+
+		if (addr >= start + size)
+			continue;
 
 		if (addr < start) {
 			size_t to_zero = min_t(size_t, start - addr, remains);
@@ -4696,8 +4700,8 @@ static size_t vmap_ram_vread_iter(struct
 		}
 
 		/*it could start reading from the middle of used region*/
-		offset = offset_in_page(addr);
-		n = ((re - rs + 1) << PAGE_SHIFT) - offset;
+		offset = addr - start;
+		n = size - offset;
 		if (n > remains)
 			n = remains;
 
_

Patches currently in -mm which might be from nickolai@csail.mit.edu are

mm-mlock-use-a-long-for-the-page-count-in-mlock_fixup.patch
mm-truncate-fix-the-zeroing-end-of-pagecache_isize_extended.patch
resource-report-a-devm_request_resource-conflict-under-the-lock.patch
mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch
mm-bdi-reset-min_ratio-after-the-sysfs-attributes-are-gone.patch

Re: + mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch added to mm-unstable branch

[Lorenzo Stoakes (ARM)]

Hi Andrew,

Please drop this until a respin is sent.

On Sat, Oct 17, 2026 at 05:12:57PM -0700, Andrew Morton wrote:
>
> The patch titled
>      Subject: mm/vmalloc: read vm_map_ram block regions from the requested offset
> has been added to the -mm mm-unstable branch.  Its filename is
>      mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch

Little unsure what mm-unstable is for during the merge window (I thought we
were leaving that alone now?) btw?

Anyway, this patch has had negative feedback from the vmalloc maintainer
[0], so should not be taken in this form, please - Ulad is vmalloc
maintainer so has final say over what lands there.

Sashiko also found an off-by-one error that you highlighted yourself [1].

I assume this isn't heading for any fixes branch?

Thanks, Lorenzo

[0]:https://lore.kernel.org/all/atSM69faDNgmLNVJ@milan/
[1]:https://lore.kernel.org/all/20261017125244.b2d7134fa9697b2982cb8cec@linux-foundation.org/

>
> This patch will shortly appear at
>      https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch
>
> This patch will later appear in the mm-unstable branch at
>     git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
>
> Before you just go and hit "reply", please:
>    a) Consider who else should be cc'ed
>    b) Prefer to cc a suitable mailing list as well
>    c) Ideally: find the original patch on the mailing list and do a
>       reply-to-all to that, adding suitable additional cc's
>
> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
>
> The -mm tree is included into linux-next via various
> branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there most days
>
> ------------------------------------------------------
> From: Nickolai Zeldovich <nickolai@csail.mit.edu>
> Subject: mm/vmalloc: read vm_map_ram block regions from the requested offset
> Date: Sat, 17 Oct 2026 19:13:25 -0400
>
> Reading a vm_map_ram() mapping through /proc/kcore returns the wrong
> memory for every page except the first page of the first used region in
> its vmap block.  read_kcore_iter() calls vread_iter() one page at a time,
> so a root user reading a live system with drgn, crash or gdb gets that
> first page in place of every later page of the mapping, and in place of
> the zeroes of the unused pages after it.  This affects every vm_map_ram()
> mapping that fits in a vmap block (up to BITS_PER_LONG pages): erofs and
> f2fs decompression buffers, videobuf2 vmalloc/dma-sg buffers, udmabuf
> vmaps, fuse readdir pages.  Kernels since v6.3 are affected.
>
> vmap_ram_vread_iter() walks the used regions of the block and, for each
> region, zero-fills up to its start and then copies from start +
> offset_in_page(addr).  A read starting in a later page of a region
> therefore copies the region's first page, and a read starting past the end
> of a region still copies from that region.
>
> Skip regions that end at or before addr, and copy from addr itself, i.e.
> use addr - start as the offset into the region.  The region is re - rs
> pages long, not re - rs + 1: for_each_set_bitrange() returns [rs, re) with
> re the first clear bit.  The extra page is one whose used_map bit is
> clear, and vb_free() clears the bits before it unmaps the pages, so a read
> racing with vm_unmap_ram() copied the page being freed instead of
> zero-filling it.
>
> Tested on x86_64 by queueing a 29-page V4L2_MEMORY_USERPTR buffer on a
> vivid capture device, which videobuf2-vmalloc maps with vm_map_ram(), page
> i starting with "userptr page i", and reading every page of its vmap block
> through /proc/kcore.  Before, all 1024 pages of the block read as page 0.
> After, pages 0..28 read back in order and the rest of the block carries no
> tag.  With a second buffer in the same block and a 100-page buffer outside
> the block path, reads at unaligned offsets, across page and region
> boundaries, into and within the unused part of the block, and of the whole
> block return the true contents.  With an msleep() inserted between the
> bitmap_clear() and the vunmap_range_noflush() of vb_free(), a read of a
> one-page buffer being unmapped between two mapped ones returns zeroes.
>
> Link: https://lore.kernel.org/20261017231325.796986-1-nickolai@csail.mit.edu
> Fixes: 06c8994626d1 ("mm/vmalloc.c: allow vread() to read out vm_map_ram areas")
> Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Assisted-by: LLM
> Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
> Cc: Baoquan He <baoquan.he@linux.dev>
> Cc: Lorenzo Stoakes <ljs@kernel.org>
> ---
>
>  mm/vmalloc.c |   10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> --- a/mm/vmalloc.c~mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset
> +++ a/mm/vmalloc.c
> @@ -4649,7 +4649,7 @@ static size_t vmap_ram_vread_iter(struct
>  	struct xarray *xa;
>  	unsigned long offset;
>  	unsigned int rs, re;
> -	size_t remains, n;
> +	size_t remains, n, size;
>
>  	/*
>  	 * If it's area created by vm_map_ram() interface directly, but
> @@ -4683,6 +4683,10 @@ static size_t vmap_ram_vread_iter(struct
>  			goto finished;
>
>  		start = vmap_block_vaddr(vb->va->va_start, rs);
> +		size = (re - rs) << PAGE_SHIFT;
> +
> +		if (addr >= start + size)
> +			continue;
>
>  		if (addr < start) {
>  			size_t to_zero = min_t(size_t, start - addr, remains);
> @@ -4696,8 +4700,8 @@ static size_t vmap_ram_vread_iter(struct
>  		}
>
>  		/*it could start reading from the middle of used region*/
> -		offset = offset_in_page(addr);
> -		n = ((re - rs + 1) << PAGE_SHIFT) - offset;
> +		offset = addr - start;
> +		n = size - offset;
>  		if (n > remains)
>  			n = remains;
>
> _
>
> Patches currently in -mm which might be from nickolai@csail.mit.edu are
>
> mm-mlock-use-a-long-for-the-page-count-in-mlock_fixup.patch
> mm-truncate-fix-the-zeroing-end-of-pagecache_isize_extended.patch
> resource-report-a-devm_request_resource-conflict-under-the-lock.patch
> mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch
> mm-bdi-reset-min_ratio-after-the-sysfs-attributes-are-gone.patch
>

--
Cheers, Lorenzo

Re: + mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch added to mm-unstable branch

[Andrew Morton]

On Fri, 30 Oct 2026 10:58:08 +0000 "Lorenzo Stoakes (ARM)" <ljs@kernel.org> wrote:

> Hi Andrew,
> 
> Please drop this until a respin is sent.

Sure.

> On Sat, Oct 17, 2026 at 05:12:57PM -0700, Andrew Morton wrote:
> >
> > The patch titled
> >      Subject: mm/vmalloc: read vm_map_ram block regions from the requested offset
> > has been added to the -mm mm-unstable branch.  Its filename is
> >      mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch
> 
> Little unsure what mm-unstable is for during the merge window (I thought we
> were leaving that alone now?) btw?

It's supposed to empty until -rc1 release (linux-next rules).  It has a
few leftovers in it at present - things which didn't get included in
the merge window.  Probably good patches but they have unresolved red
marks which I need to circle back on and figure out.

#mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success.patch: TBU? (changelog).  -stable?
mm-zswap-validate-dlen-and-normalize-comp_ret-on-compression-success.patch
#
#mm-nommu-set-mmf_oom_skip-in-exit_mmap.patch: https://lore.kernel.org/as80Rpm-VHhP14aK@tiehlicka acks? bogus: https://lore.kernel.org/atB63fzpLyfWpzPn@tiehlicka TBU (changelog)
mm-nommu-set-mmf_oom_skip-in-exit_mmap.patch
#
#fs-proc-task_mmu-fix-lost-maps-entries-above-263.patch: TBU (changelog): https://lore.kernel.org/as5M1BSWcPDHjEWt@gremlin.  Suren?
fs-proc-task_mmu-fix-lost-maps-entries-above-263.patch
#
#mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch: acks? https://lore.kernel.org/atSM69faDNgmLNVJ@milan TBU
mm-vmalloc-read-vm_map_ram-block-regions-from-the-requested-offset.patch

Apart from the vmalloc one, they're good patches which just need
changelog tweaks and maintainer pokes to get them over the line.

> Anyway, this patch has had negative feedback from the vmalloc maintainer
> [0], so should not be taken in this form, please - Ulad is vmalloc
> maintainer so has final say over what lands there.
> 
> Sashiko also found an off-by-one error that you highlighted yourself [1].

oops, forgot about that, thanks.

> I assume this isn't heading for any fixes branch?

Nothing goes anywhere until the little red marks get rubbed out.

The patches which need changelog updates I'll probably do myself.