From: Andrew Morton <akpm@linux-foundation.org>
To: Hajime Tazaki <thehajime@gmail.com>
Cc: liam@infradead.org, ljs@kernel.org, vbabka@kernel.org,
jannh@google.com, pfalcato@suse.de, linux-mm@kvack.org,
geert@linux-m68k.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/2] mm: nommu: fix the error path when vma_iter_prealloc() fails
Date: Tue, 7 Jul 2026 17:39:10 -0700 [thread overview]
Message-ID: <20260707173910.928c74a7e4dc8a1fdfddae3d@linux-foundation.org> (raw)
In-Reply-To: <20260707235137.498738-1-thehajime@gmail.com>
On Wed, 8 Jul 2026 08:51:36 +0900 Hajime Tazaki <thehajime@gmail.com> wrote:
> When vma_iter_prealloc() fails in do_mmap(), it jumps to error_just_free
> without updating ret to -ENOMEM, meaning do_mmap() will return 0 on
> failure.
>
> Additionally, this error path unconditionally frees the region struct.
> Since the region was already added to the global nommu_region_tree via
> add_nommu_region(), leaving it makes a potential dangling pointer in
> the tree and may cause a use-after-free on the next tree walk.
>
> This commit fixes those issues by introducing new jump
> label, error_vma_iter_prealloc, to correctly handle the error case of
> vma_iter_prealloc(), and move the region updates after the place that
> the allocation is finished.
>
> Those issues are discovered by Sashiko, linked below.
Thanks. Now I'm wondering if you regret opening this can of worms ;)
https://sashiko.dev/#/patchset/20260707235137.498738-1-thehajime@gmail.com
afaict, all these issues pertain to failures from vma_iter_prealloc().
next prev parent reply other threads:[~2026-07-08 0:39 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-07 23:51 [PATCH 1/2] mm: nommu: fix the error path when vma_iter_prealloc() fails Hajime Tazaki
2026-07-07 23:51 ` [PATCH 2/2] mm: nommu: fix error handling on vma_iter_prealloc() failure Hajime Tazaki
2026-07-08 0:39 ` Andrew Morton [this message]
2026-07-08 1:13 ` [PATCH 1/2] mm: nommu: fix the error path when vma_iter_prealloc() fails Hajime Tazaki
2026-07-08 13:18 ` Hajime Tazaki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260707173910.928c74a7e4dc8a1fdfddae3d@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=geert@linux-m68k.org \
--cc=jannh@google.com \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=pfalcato@suse.de \
--cc=thehajime@gmail.com \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox