Re: [PATCH 10/13] mm/migrate_device: refuse to migrate shadow stacks

[Roman Gushchin <roman.gushchin@linux.dev>]

> On Nov 12, 2026, at 11:03 AM, Lorenzo Stoakes (ARM) <ljs@kernel.org> wrote:
> 
> +cc Roman
> 
> Roman - see below - I was under the impression mm was not supposed to receive
> 'unrelated to this patch but' reports? Did something change?
> 
> Thanks!
> 
>> On Thu, Nov 12, 2026 at 06:16:31PM +0000, sashiko-bot@kernel.org wrote:
>> Thank you for your contribution! Sashiko AI review found no new issues
>> in this patch, but noticed 1 related pre-existing issue it does not
>> introduce:
>> - [Critical] mm: out-of-bounds write in migrate_vma_setup() [1]
>> --
>> 
>> commit a0bf8430c5e68cd904038ab8081c7bc9a9b0f7de
>> Author: Chris Mason <mason@kernel.org>
>> 
>> mm/migrate_device: refuse to migrate shadow stacks
>> 
>> This commit rejects VMA device migration in migrate_vma_setup() when the VMA
>> has VMA_SHADOW_STACK set.
>> 
>>> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
>>> index 0f2a2832e0bd1..c27f513ee46e3 100644
>>> --- a/mm/migrate_device.c
>>> +++ b/mm/migrate_device.c
>>> @@ -759,6 +759,8 @@ int migrate_vma_setup(struct migrate_vma *args)
>>>    /* The migrate_vma page walk has no hugetlb support. */
>>>    if (!vma_is_mm_backed(vma) || vma_is_hugetlb(vma) || vma_is_dax(vma))
>>>        return -EINVAL;
>>> +    if (vma_test_single_mask(vma, VMA_SHADOW_STACK))
>>> +        return -EINVAL;
>>>    if (nr_pages <= 0)
>>>        return -EINVAL;
>>>    if (args->start < vma->vm_start || args->start >= vma->vm_end)
>> 
>> [Severity: Critical]
>> This problem wasn't introduced by this patch, but can migrate_vma_setup()
>> write out of bounds on args->src and args->dst when given unaligned
>> addresses [1]?
> 
> I don't like big buts and I can deny! As above, I thought we disabled this?
>> 
>> mm/migrate_device.c:migrate_vma_setup() {
>>    const struct vm_area_struct *vma = args->vma;
>>    long nr_pages = (args->end - args->start) >> PAGE_SHIFT;
>> 
>>    args->start &= PAGE_MASK;
>>    args->end &= PAGE_MASK;
>>    ...
>> }
>> 
>> nr_pages is computed before args->start and args->end are masked with
>> PAGE_MASK.  For example, if args->start is 0x1fff and args->end is 0x3001,
>> nr_pages is 1, but masking rounds the range to [0x1000, 0x3000), which spans
>> 2 pages.  When migrate_vma_collect() walks the aligned range, it writes past
>> the end of the caller's args->src and args->dst arrays.
> 
> This is silly. It's not critical. Nothing in-tree does this.
> 
> If internal kernel stuff does incredibly stupid things then incredibly stupid
> things happen. We can't nanny everything endlessly.
> 
> A monolithic kernel means that the function and its callers are considered
> together.

Agreed. Let me try to fix this to stop reporting problems like this.