[PATCH bpf-next] bpf: Fix use-after-free in arena_vm_close on fork

[PATCH bpf-next] bpf: Fix use-after-free in arena_vm_close on fork

[Alexei Starovoitov]

From: Alexei Starovoitov <ast@kernel.org>

arena_vm_open() only bumps vml->mmap_count but never registers the
child VMA in arena->vma_list. The vml->vma always points at the
parent VMA, so after parent munmap the pointer dangles. If the child
then calls bpf_arena_free_pages(), zap_pages() reads the stale
vml->vma triggering use-after-free.

Fix this by preventing the arena VMA from being inherited across
fork with VM_DONTCOPY, and preventing VMA splits via the may_split
callback.

Also reject mremap with a .mremap callback returning -EINVAL. A
same-size mremap(MREMAP_FIXED) on the full arena VMA reaches
copy_vma() through the following path:

  check_prep_vma()       - returns 0 early: new_len == old_len
                           skips VM_DONTEXPAND check
  prep_move_vma()        - vm_start == old_addr and
                           vm_end == old_addr + old_len
                           so may_split is never called
  move_vma()
    copy_vma_and_data()
      copy_vma()
        vm_area_dup()    - copies vm_private_data (vml pointer)
        vm_ops->open()   - bumps vml->mmap_count
      vm_ops->mremap()   - returns -EINVAL, rollback unmaps new VMA

The refcount ensures the rollback's arena_vm_close does not free
the vml shared with the original VMA.

Reported-by: Weiming Shi <bestswngs@gmail.com>
Reported-by: Xiang Mei <xmei5@asu.edu>
Fixes: 317460317a02 ("bpf: Introduce bpf_arena.")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
 kernel/bpf/arena.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
index f355cf1c1a16..9c68c9b0b24a 100644
--- a/kernel/bpf/arena.c
+++ b/kernel/bpf/arena.c
@@ -341,6 +341,16 @@ static void arena_vm_open(struct vm_area_struct *vma)
 	refcount_inc(&vml->mmap_count);
 }
 
+static int arena_vm_may_split(struct vm_area_struct *vma, unsigned long addr)
+{
+	return -EINVAL;
+}
+
+static int arena_vm_mremap(struct vm_area_struct *vma)
+{
+	return -EINVAL;
+}
+
 static void arena_vm_close(struct vm_area_struct *vma)
 {
 	struct bpf_map *map = vma->vm_file->private_data;
@@ -417,6 +427,8 @@ static vm_fault_t arena_vm_fault(struct vm_fault *vmf)
 
 static const struct vm_operations_struct arena_vm_ops = {
 	.open		= arena_vm_open,
+	.may_split	= arena_vm_may_split,
+	.mremap		= arena_vm_mremap,
 	.close		= arena_vm_close,
 	.fault          = arena_vm_fault,
 };
@@ -486,10 +498,11 @@ static int arena_map_mmap(struct bpf_map *map, struct vm_area_struct *vma)
 	arena->user_vm_end = vma->vm_end;
 	/*
 	 * bpf_map_mmap() checks that it's being mmaped as VM_SHARED and
-	 * clears VM_MAYEXEC. Set VM_DONTEXPAND as well to avoid
-	 * potential change of user_vm_start.
+	 * clears VM_MAYEXEC. Set VM_DONTEXPAND to avoid potential change
+	 * of user_vm_start. Set VM_DONTCOPY to prevent arena VMA from
+	 * being copied into the child process on fork.
 	 */
-	vm_flags_set(vma, VM_DONTEXPAND);
+	vm_flags_set(vma, VM_DONTEXPAND | VM_DONTCOPY);
 	vma->vm_ops = &arena_vm_ops;
 	return 0;
 }
-- 
2.52.0

Re: [PATCH bpf-next] bpf: Fix use-after-free in arena_vm_close on fork

[Emil Tsalapatis]

On Mon Apr 13, 2026 at 3:42 PM EDT, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
>
> arena_vm_open() only bumps vml->mmap_count but never registers the
> child VMA in arena->vma_list. The vml->vma always points at the
> parent VMA, so after parent munmap the pointer dangles. If the child
> then calls bpf_arena_free_pages(), zap_pages() reads the stale
> vml->vma triggering use-after-free.
>
> Fix this by preventing the arena VMA from being inherited across
> fork with VM_DONTCOPY, and preventing VMA splits via the may_split
> callback.
>
> Also reject mremap with a .mremap callback returning -EINVAL. A
> same-size mremap(MREMAP_FIXED) on the full arena VMA reaches
> copy_vma() through the following path:
>
>   check_prep_vma()       - returns 0 early: new_len == old_len
>                            skips VM_DONTEXPAND check
>   prep_move_vma()        - vm_start == old_addr and
>                            vm_end == old_addr + old_len
>                            so may_split is never called
>   move_vma()
>     copy_vma_and_data()
>       copy_vma()
>         vm_area_dup()    - copies vm_private_data (vml pointer)
>         vm_ops->open()   - bumps vml->mmap_count
>       vm_ops->mremap()   - returns -EINVAL, rollback unmaps new VMA
>
> The refcount ensures the rollback's arena_vm_close does not free
> the vml shared with the original VMA.
>
> Reported-by: Weiming Shi <bestswngs@gmail.com>
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Fixes: 317460317a02 ("bpf: Introduce bpf_arena.")
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

With this fix we now properly use the refcnt to keep a single vml for
all users of an arena, since having a reference to the arena implies a
successful mmap() call.

> ---
>  kernel/bpf/arena.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> index f355cf1c1a16..9c68c9b0b24a 100644
> --- a/kernel/bpf/arena.c
> +++ b/kernel/bpf/arena.c
> @@ -341,6 +341,16 @@ static void arena_vm_open(struct vm_area_struct *vma)
>  	refcount_inc(&vml->mmap_count);
>  }
>  
> +static int arena_vm_may_split(struct vm_area_struct *vma, unsigned long addr)
> +{
> +	return -EINVAL;
> +}
> +
> +static int arena_vm_mremap(struct vm_area_struct *vma)
> +{
> +	return -EINVAL;
> +}
> +
>  static void arena_vm_close(struct vm_area_struct *vma)
>  {
>  	struct bpf_map *map = vma->vm_file->private_data;
> @@ -417,6 +427,8 @@ static vm_fault_t arena_vm_fault(struct vm_fault *vmf)
>  
>  static const struct vm_operations_struct arena_vm_ops = {
>  	.open		= arena_vm_open,
> +	.may_split	= arena_vm_may_split,
> +	.mremap		= arena_vm_mremap,
>  	.close		= arena_vm_close,
>  	.fault          = arena_vm_fault,
>  };
> @@ -486,10 +498,11 @@ static int arena_map_mmap(struct bpf_map *map, struct vm_area_struct *vma)
>  	arena->user_vm_end = vma->vm_end;
>  	/*
>  	 * bpf_map_mmap() checks that it's being mmaped as VM_SHARED and
> -	 * clears VM_MAYEXEC. Set VM_DONTEXPAND as well to avoid
> -	 * potential change of user_vm_start.
> +	 * clears VM_MAYEXEC. Set VM_DONTEXPAND to avoid potential change
> +	 * of user_vm_start. Set VM_DONTCOPY to prevent arena VMA from
> +	 * being copied into the child process on fork.
>  	 */
> -	vm_flags_set(vma, VM_DONTEXPAND);
> +	vm_flags_set(vma, VM_DONTEXPAND | VM_DONTCOPY);
>  	vma->vm_ops = &arena_vm_ops;
>  	return 0;
>  }

Re: [PATCH bpf-next] bpf: Fix use-after-free in arena_vm_close on fork

[Barret Rhoden]

On 4/13/26 3:42 PM, Alexei Starovoitov wrote:
> @@ -486,10 +498,11 @@ static int arena_map_mmap(struct bpf_map *map, struct vm_area_struct *vma)
>   	arena->user_vm_end = vma->vm_end;
>   	/*
>   	 * bpf_map_mmap() checks that it's being mmaped as VM_SHARED and
> -	 * clears VM_MAYEXEC. Set VM_DONTEXPAND as well to avoid
> -	 * potential change of user_vm_start.
> +	 * clears VM_MAYEXEC. Set VM_DONTEXPAND to avoid potential change
> +	 * of user_vm_start. Set VM_DONTCOPY to prevent arena VMA from
> +	 * being copied into the child process on fork.
>   	 */
> -	vm_flags_set(vma, VM_DONTEXPAND);
> +	vm_flags_set(vma, VM_DONTEXPAND | VM_DONTCOPY);

i think on older kernels, VM_DONTCOPY alone isn't enough, due to the 
whole MADVISE_DOFORK mess.  Linus added something to catch this in

https://github.com/torvalds/linux/commit/0b2758f48f22b173963f39e553d0ecd05f3b4433

(Just a note to any backporters out there...)  =)

thanks for the fix

barret


>   	vma->vm_ops = &arena_vm_ops;
>   	return 0;
>   }

Re: [PATCH bpf-next] bpf: Fix use-after-free in arena_vm_close on fork

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Mon, 13 Apr 2026 12:42:45 -0700 you wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> arena_vm_open() only bumps vml->mmap_count but never registers the
> child VMA in arena->vma_list. The vml->vma always points at the
> parent VMA, so after parent munmap the pointer dangles. If the child
> then calls bpf_arena_free_pages(), zap_pages() reads the stale
> vml->vma triggering use-after-free.
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Fix use-after-free in arena_vm_close on fork
    https://git.kernel.org/bpf/bpf/c/4fddde2a732d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html