[PATCH] fs/proc/task_mmu: pin the mm during PAGEMAP_SCAN

[PATCH] fs/proc/task_mmu: pin the mm during PAGEMAP_SCAN

[Kyle Zeng]

A pagemap file holds an mm_count reference, not an mm_users reference.
Unlike pagemap_read(), do_pagemap_scan() does not acquire a live-MM
reference before walking the page tables. Its mmap read lock does not
exclude the first phase of exit_mmap(), which also unmaps VMAs under the
read lock.

A process retaining a pagemap descriptor can therefore race the final
mmput() and access resources that have already been released. In
particular, a concurrent last userfaultfd close can free a context still
reachable through a dying MM's VMAs, and unmap_vmas() can free a shared
HugeTLB VMA's lock while the page walker is entering down_read(). KASAN
reports both a userfaultfd context read-after-free and a HugeTLB rwsem
write-after-free with unprivileged, read-only PAGEMAP_SCAN requests.

Acquire mmget_not_zero() after validating the ioctl arguments and keep
the reference for the entire scan, including across mmap lock drops and
MMU-notifier operations. Return -ESRCH if the MM is already dead, as
PROCMAP_QUERY does. Balance the reference on the bounce-buffer allocation
failure path and at the common exit. The pagemap file continues to hold
only its existing mm_count reference between operations.

Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
I have a reproducer for this issue.

 fs/proc/task_mmu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 5c54aebe2118..d2cee8dcba58 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -3235,11 +3235,14 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg)
 	if (ret)
 		return ret;
 
+	if (!mmget_not_zero(mm))
+		return -ESRCH;
+
 	p.masks_of_interest = p.arg.category_mask | p.arg.category_anyof_mask |
 			      p.arg.return_mask;
 	ret = pagemap_scan_init_bounce_buffer(&p);
 	if (ret)
-		return ret;
+		goto out_mm;
 
 	for (walk_start = p.arg.start; walk_start < p.arg.end;
 			walk_start = p.arg.walk_end) {
@@ -3294,6 +3297,8 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg)
 		ret = -EFAULT;
 
 	kfree(p.vec_buf);
+out_mm:
+	mmput(mm);
 	return ret;
 }
 

Re: [PATCH] fs/proc/task_mmu: pin the mm during PAGEMAP_SCAN

[David Hildenbrand (Arm)]

On 10/24/26 05:56, Kyle Zeng wrote:
> A pagemap file holds an mm_count reference, not an mm_users reference.
> Unlike pagemap_read(), do_pagemap_scan() does not acquire a live-MM
> reference before walking the page tables. Its mmap read lock does not
> exclude the first phase of exit_mmap(), which also unmaps VMAs under the
> read lock.
> 
> A process retaining a pagemap descriptor can therefore race the final
> mmput() and access resources that have already been released. In
> particular, a concurrent last userfaultfd close can free a context still
> reachable through a dying MM's VMAs, and unmap_vmas() can free a shared
> HugeTLB VMA's lock while the page walker is entering down_read(). KASAN
> reports both a userfaultfd context read-after-free and a HugeTLB rwsem
> write-after-free with unprivileged, read-only PAGEMAP_SCAN requests.
> 
> Acquire mmget_not_zero() after validating the ioctl arguments and keep
> the reference for the entire scan, including across mmap lock drops and
> MMU-notifier operations. Return -ESRCH if the MM is already dead, as
> PROCMAP_QUERY does. Balance the reference on the bounce-buffer allocation
> failure path and at the common exit. The pagemap file continues to hold
> only its existing mm_count reference between operations.
> 
> Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> ---
> I have a reproducer for this issue.
> 
>  fs/proc/task_mmu.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 5c54aebe2118..d2cee8dcba58 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -3235,11 +3235,14 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg)
>  	if (ret)
>  		return ret;
>  
> +	if (!mmget_not_zero(mm))
> +		return -ESRCH;
> +
>  	p.masks_of_interest = p.arg.category_mask | p.arg.category_anyof_mask |
>  			      p.arg.return_mask;
>  	ret = pagemap_scan_init_bounce_buffer(&p);
>  	if (ret)
> -		return ret;
> +		goto out_mm;
>  
>  	for (walk_start = p.arg.start; walk_start < p.arg.end;
>  			walk_start = p.arg.walk_end) {
> @@ -3294,6 +3297,8 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg)
>  		ret = -EFAULT;
>  
>  	kfree(p.vec_buf);
> +out_mm:
> +	mmput(mm);
>  	return ret;
>  }
>  
> 

Please take a look at the list before posting.

https://lore.kernel.org/r/20261014095540.3261469-1-ngocquy0700@gmail.com

-- 
Cheers,

David