From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 960C32EC0A2; Thu, 2 Apr 2026 04:17:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775103424; cv=none; b=HlIQ7Ck0xRw5E80AdCit2hlrWtc2umdsk6ShmITeT5Ydc3Q6l1RvnAFa6fuofP5BL5wN7RagchlIcJ+eo0KS0Ypp/FeJSRXjRBt+z7CmdFTv2jwfFPhvwEVeHxezEWCJIeguPgUOX5V8ks8q92dPxGnPF9oIeHvNQecvkCJxmLM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775103424; c=relaxed/simple; bh=awFoLWkQ8BuHAli93Y5A7C0YLpFtjzyD8P6Wm93Jy7w=; h=Date:To:From:Subject:Message-Id; b=tChJvzikkUccfZHyDJWgnNtUD5peEyKwvZ50piE/FKmN3W9ybIlBUv6qUkSMEqshRtCqBLFn2K5liwqZu86hz2mEbu5Mclunr34myhrfihEU4v7rgAqCWz/LBd6SKlaY2FsknFklwt6J4ad+DcAzGFflRbn08QLjE64LALxrGSc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=CPl95Xi2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="CPl95Xi2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F02EC19423; Thu, 2 Apr 2026 04:17:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1775103424; bh=awFoLWkQ8BuHAli93Y5A7C0YLpFtjzyD8P6Wm93Jy7w=; h=Date:To:From:Subject:From; b=CPl95Xi23FU4LCrrnEARnuE/dGbA8Aobm+fT2uYPOFIKacBGaLBmT7OGZ9J4I50VH weHAWQw0jXOIuGR0CCegfcLtj1gJ0ndDI919koL0iBdjleLvnWs+i+6abimAWEKQLP 8r1usoFYepldFgeED5uykh1kzHRLZBcTY8rg7EVw= Date: Wed, 01 Apr 2026 21:17:03 -0700 To: mm-commits@vger.kernel.org,tejas.bharambe@outlook.com,stable@vger.kernel.org,piaojun@huawei.com,mark@fasheh.com,junxiao.bi@oracle.com,joseph.qi@linux.alibaba.com,jlbec@evilplan.org,heming.zhao@suse.com,gechangwei@live.cn,thbharam@gmail.com,akpm@linux-foundation.org From: Andrew Morton Subject: + ocfs2-fix-use-after-free-in-ocfs2_fault-when-vm_fault_retry.patch added to mm-nonmm-unstable branch Message-Id: <20260402041704.0F02EC19423@smtp.kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The patch titled Subject: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY has been added to the -mm mm-nonmm-unstable branch. Its filename is ocfs2-fix-use-after-free-in-ocfs2_fault-when-vm_fault_retry.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-fix-use-after-free-in-ocfs2_fault-when-vm_fault_retry.patch This patch will later appear in the mm-nonmm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Tejas Bharambe Subject: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Date: Wed, 1 Apr 2026 21:02:34 -0700 filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free. Fix this by saving the inode reference before calling filemap_fault(), and removing vma from the trace event. The inode remains valid across the lock drop since the file is still open, so the trace can fire in all cases without dereferencing the potentially freed vma. Link: https://lkml.kernel.org/r/20260402040234.92432-1-tejas.bharambe@outlook.com Signed-off-by: Tejas Bharambe Reported-by: syzbot+a49010a0e8fcdeea075f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a49010a0e8fcdeea075f Suggested-by: Joseph Qi Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Cc: Signed-off-by: Andrew Morton --- fs/ocfs2/mmap.c | 6 +++--- fs/ocfs2/ocfs2_trace.h | 10 ++++------ 2 files changed, 7 insertions(+), 9 deletions(-) --- a/fs/ocfs2/mmap.c~ocfs2-fix-use-after-free-in-ocfs2_fault-when-vm_fault_retry +++ a/fs/ocfs2/mmap.c @@ -30,7 +30,7 @@ static vm_fault_t ocfs2_fault(struct vm_fault *vmf) { - struct vm_area_struct *vma = vmf->vma; + struct inode *inode = file_inode(vmf->vma->vm_file); sigset_t oldset; vm_fault_t ret; @@ -38,8 +38,8 @@ static vm_fault_t ocfs2_fault(struct vm_ ret = filemap_fault(vmf); ocfs2_unblock_signals(&oldset); - trace_ocfs2_fault(OCFS2_I(vma->vm_file->f_mapping->host)->ip_blkno, - vma, vmf->page, vmf->pgoff); + trace_ocfs2_fault(OCFS2_I(inode)->ip_blkno, + vmf->page, vmf->pgoff); return ret; } --- a/fs/ocfs2/ocfs2_trace.h~ocfs2-fix-use-after-free-in-ocfs2_fault-when-vm_fault_retry +++ a/fs/ocfs2/ocfs2_trace.h @@ -1246,22 +1246,20 @@ TRACE_EVENT(ocfs2_write_end_inline, TRACE_EVENT(ocfs2_fault, TP_PROTO(unsigned long long ino, - void *area, void *page, unsigned long pgoff), - TP_ARGS(ino, area, page, pgoff), + void *page, unsigned long pgoff), + TP_ARGS(ino, page, pgoff), TP_STRUCT__entry( __field(unsigned long long, ino) - __field(void *, area) __field(void *, page) __field(unsigned long, pgoff) ), TP_fast_assign( __entry->ino = ino; - __entry->area = area; __entry->page = page; __entry->pgoff = pgoff; ), - TP_printk("%llu %p %p %lu", - __entry->ino, __entry->area, __entry->page, __entry->pgoff) + TP_printk("%llu %p %lu", + __entry->ino, __entry->page, __entry->pgoff) ); /* End of trace events for fs/ocfs2/mmap.c. */ _ Patches currently in -mm which might be from thbharam@gmail.com are ocfs2-fix-use-after-free-in-ocfs2_fault-when-vm_fault_retry.patch