From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 437682FFDF8; Tue, 23 Dec 2025 17:29:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766510974; cv=none; b=DY+KqUZNgy3pjYrvr0/ui3CRATlRAwTQRjQzpGpHwaleaNJ0AITksmGmm1FxVMssZeY4cgnj5FcSDHgVeck0RhSNpt7xaVZ8q+VJNbWN8vDQioZFVx3zvE8IEgiKNqjtQPsImdgKb02Heneu7f2bHI61oT1qmju/WlSEbZS1bcs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766510974; c=relaxed/simple; bh=ZnMNgOIJ96A3TljGb6Gjf1ywJrE3ikzcuoOhLH8WkI0=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=mYlZyL9gct2oZhUeQmBEnx7vHInO70DYxurJNccM0WETBT8NvoY16c5j8Tk8CTkfhk4MbZ5WDnlRwQFlH/Z9/9msPB3Z6lYPjfNOL5J/fwRqdwY3xCVLkBFsxHcVBFQWeWgL4Rw9HpjFdEPGkphuSxFQto9M/pmhWJyZy2xEPi8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=dbJVK1ci; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="dbJVK1ci" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B365C113D0; Tue, 23 Dec 2025 17:29:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1766510973; bh=ZnMNgOIJ96A3TljGb6Gjf1ywJrE3ikzcuoOhLH8WkI0=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=dbJVK1ciaKHHRK/29VJnkq+1MhARtI9KjDqmvMld4FXjdtp59K1OJPjOL7d1DTxWK wJhgaPtpSfagISqSzNwxoc9rmZ2TskAJbzSMzfyukAMvfroDbUO8iCIHvteUEgJ75l 2VVev55R3S871W2NFc01T8rA4swhN5U9iEYfZImI= Date: Tue, 23 Dec 2025 09:29:32 -0800 From: Andrew Morton To: Jinchao Wang Cc: Song Liu , Jiri Olsa , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com, Axel Rasmussen , David Hildenbrand (Red Hat) , Johannes Weiner , Lorenzo Stoakes , Michal Hocko , Qi Zheng , Shakeel Butt , Wei Xu , Yuanchu Xie , Andrii Nakryiko , Eduard Zingerman , Omar Sandoval , Deepanshu Kartikey , Alexei Starovoitov , Daniel Borkman , Hao Luo , Jiri Olsa , John Fastabend , KP Singh , Martin KaFai Lau , Song Liu , Stanislav Fomichev , Yonghong Song Subject: Re: [PATCH] buildid: validate page-backed file before parsing build ID Message-Id: <20251223092932.0a804e046fc2e5de236ced69@linux-foundation.org> In-Reply-To: <20251223103214.2412446-1-wangjinchao600@gmail.com> References: <20251223103214.2412446-1-wangjinchao600@gmail.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Tue, 23 Dec 2025 18:32:07 +0800 Jinchao Wang wrote: > __build_id_parse() only works on page-backed storage. Its helper paths > eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs > that do not map a regular file or lack valid address_space operations. > > Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com > Signed-off-by: Jinchao Wang > > ... > > --- a/lib/buildid.c > +++ b/lib/buildid.c > @@ -280,7 +280,10 @@ static int __build_id_parse(struct vm_area_struct *vma, unsigned char *build_id, > int ret; > > /* only works for page backed storage */ > - if (!vma->vm_file) > + if (!vma->vm_file || > + !S_ISREG(file_inode(vma->vm_file)->i_mode) || > + !vma->vm_file->f_mapping->a_ops || > + !vma->vm_file->f_mapping->a_ops->read_folio) > return -EINVAL; > > freader_init_from_file(&r, buf, sizeof(buf), vma->vm_file, may_fault); Thanks. Seems this one needs additional paperwork. I added the below: Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API") Tested-by: Link: https://lkml.kernel.org/r/694a67ab.050a0220.19928e.001c.GAE@google.com Closes: https://lkml.kernel.org/r/693540fe.a70a0220.38f243.004c.GAE@google.com Cc: and a large number of cc's which I scraped together from various emails. Could people please eyeball all of this and verify that everything is good? From: Jinchao Wang Subject: buildid: validate page-backed file before parsing build ID Date: Tue, 23 Dec 2025 18:32:07 +0800 __build_id_parse() only works on page-backed storage. Its helper paths eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs that do not map a regular file or lack valid address_space operations. Link: https://lkml.kernel.org/r/20251223103214.2412446-1-wangjinchao600@gmail.com Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API") Signed-off-by: Jinchao Wang Reported-by: Tested-by: Link: https://lkml.kernel.org/r/694a67ab.050a0220.19928e.001c.GAE@google.com Closes: https://lkml.kernel.org/r/693540fe.a70a0220.38f243.004c.GAE@google.com Cc: Axel Rasmussen Cc: David Hildenbrand (Red Hat) Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Wei Xu Cc: Yuanchu Xie Cc: Andrii Nakryiko Cc: Eduard Zingerman Cc: Omar Sandoval Cc: Deepanshu Kartikey Cc: Alexei Starovoitov Cc: Daniel Borkman Cc: Hao Luo Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Song Liu Cc: Stanislav Fomichev Cc: Yonghong Song Cc: Signed-off-by: Andrew Morton --- lib/buildid.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/lib/buildid.c~buildid-validate-page-backed-file-before-parsing-build-id +++ a/lib/buildid.c @@ -288,7 +288,10 @@ static int __build_id_parse(struct vm_ar int ret; /* only works for page backed storage */ - if (!vma->vm_file) + if (!vma->vm_file || + !S_ISREG(file_inode(vma->vm_file)->i_mode) || + !vma->vm_file->f_mapping->a_ops || + !vma->vm_file->f_mapping->a_ops->read_folio) return -EINVAL; freader_init_from_file(&r, buf, sizeof(buf), vma->vm_file, may_fault); _