Re: [PATCH bpf-next] bpf: Fix use-after-free in arena_vm_close on fork

[Barret Rhoden <brho@google.com>]

On 4/13/26 3:42 PM, Alexei Starovoitov wrote:
> @@ -486,10 +498,11 @@ static int arena_map_mmap(struct bpf_map *map, struct vm_area_struct *vma)
>   	arena->user_vm_end = vma->vm_end;
>   	/*
>   	 * bpf_map_mmap() checks that it's being mmaped as VM_SHARED and
> -	 * clears VM_MAYEXEC. Set VM_DONTEXPAND as well to avoid
> -	 * potential change of user_vm_start.
> +	 * clears VM_MAYEXEC. Set VM_DONTEXPAND to avoid potential change
> +	 * of user_vm_start. Set VM_DONTCOPY to prevent arena VMA from
> +	 * being copied into the child process on fork.
>   	 */
> -	vm_flags_set(vma, VM_DONTEXPAND);
> +	vm_flags_set(vma, VM_DONTEXPAND | VM_DONTCOPY);

i think on older kernels, VM_DONTCOPY alone isn't enough, due to the 
whole MADVISE_DOFORK mess.  Linus added something to catch this in

https://github.com/torvalds/linux/commit/0b2758f48f22b173963f39e553d0ecd05f3b4433

(Just a note to any backporters out there...)  =)

thanks for the fix

barret


>   	vma->vm_ops = &arena_vm_ops;
>   	return 0;
>   }