Re: [PATCH bpf-next v5] bpf: Fix use-after-free on mm_struct in bpf_find_vma()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Low] The patch removes the `bpf_iter_mmput_async()` helper function but leaves an active call to it in `bpf_iter_task_vma_destroy()`, causing an unconditional compilation failure.
- [Low] Calling `mmput_async()` directly causes a build failure on configurations without `CONFIG_MMU` and `CONFIG_FUTEX_PRIVATE_HASH`.
--

commit 2e44c7b3855fc202fcf8df33fd8efe7bae06e921
Author: Sanghyun Park <sanghyun.park.cnu@gmail.com>
Subject: bpf: Fix use-after-free on mm_struct in bpf_find_vma()

This commit addresses a use-after-free in bpf_find_vma() by safely
pinning task->mm for foreign tasks under alloc_lock. It adds a required
mmput_async() call on the exit path and removes the static inline wrapper
bpf_iter_mmput_async().

> diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
> index e791ae065c39b..27ceead874651 100644
> --- a/kernel/bpf/task_iter.c
> +++ b/kernel/bpf/task_iter.c

[ ... ]

> @@ -782,6 +807,9 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
>  		ret = 0;
>  	}
>  	bpf_mmap_unlock_mm(work, mm);
> +out:
> +	if (mmput_needed)
> +		mmput_async(mm);

[Severity: Low]
Does directly invoking mmput_async() break the build on configurations
without CONFIG_MMU?

The removed bpf_iter_mmput_async() wrapper previously fell back to mmput()
when CONFIG_MMU was disabled. Even though this new path is guarded by a
runtime IS_ENABLED(CONFIG_MMU) check earlier in the function, the C compiler
still evaluates the function call, which might be undeclared in the headers
on !CONFIG_MMU builds.

>  	return ret;
>  }
>  
> @@ -796,15 +824,6 @@ const struct bpf_func_proto bpf_find_vma_proto = {
>  	.arg5_type	= ARG_ANYTHING,
>  };
>  
> -static inline void bpf_iter_mmput_async(struct mm_struct *mm)
> -{
> -#ifdef CONFIG_MMU
> -	mmput_async(mm);
> -#else
> -	mmput(mm);
> -#endif
> -}
> -

[Severity: Low]
Does the removal of bpf_iter_mmput_async() cause a build failure?

While the wrapper was removed here, it looks like it is still being called
further down in the file:

kernel/bpf/task_iter.c:bpf_iter_task_vma_destroy() {
        ...
        if (kit->data) {
                bpf_iter_task_vma_snapshot_reset(&kit->data->snapshot);
                put_task_struct(kit->data->task);
                bpf_iter_mmput_async(kit->data->mm);
                ...
        }
}

Will this cause an undeclared identifier error when compiling
bpf_iter_task_vma_destroy()?

>  struct bpf_iter_task_vma_kern_data {
>  	struct task_struct *task;
>  	struct mm_struct *mm;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630023443.3026627-2-sanghyun.park.cnu@gmail.com?part=1