From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794051061; b=e1t4IfQGzVMYa5Q65A7lV3ZJuLsPA9sfAfK+SRD0yN0FD8gO95VaT+HvMUnZ4WA/G7vm oQj33Dhi/nqSoiUWH73aMRZNGymuXQ8uKZFftVyBEAAM7+RCKn13AGR9PG4Id7XIrSBgu kSipRZ6YHl8nvqwz7MsomJjJgCQAj3d1pcGKuDeQ3hwkS/1Gy/ny3mvnrAc40TtX2uS8D 4rk0RMw1fdUvTPBtcxgctGLf+05rfZzcxRGrppl6Vpwz9HasNt6KVV3x8ZEJ0x1WT49nt q/JUpy7Sk+OHIeE90ehk47AhVNCd5Fyqdsq1DlEKc44S9dW/Avy5g5UiBDla6eFvUeg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794051061; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=6sO6Askn+c0tDRxRzmc1YTbR/Q/W0yPBBIUa+eOh4bc=; b=ycPvW5HcN0IMAaNP7mfyWAy9ztzDBxkSIf/8viSZWJJhJhRMIpccv6Em84tn+AZqklbH 39KgQ3bwlBIwKNria0fV2pB7e7hl4EPDdWGjpoLChs8BG1lYqHYrjPNrRt6dtqACIWF0K mHTBbpmcH3RqmKKXE5IdrZNmJryuhj1qKt04I/g/MLieaRfJVK3jxM8iDfpCWrzz9Fvfi c+w4Z69JmzYgupYpMt48e6pQ+4e7VmzbtaFkb8vVCnVM2CE7IMhznYPSTQiu5LQTlnYc1 VJw3tW9pmjl2bprfJaQjNDu0IPWZSrnEDu0AnJgyJSsyK39sU8OMb4zL5AV/tSlEAgQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=cwcXY8Gk; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 35642606A326 for ; Sat, 7 Nov 2026 11:31:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=cwcXY8Gk Received: by smtp.kernel.org (Postfix) with ESMTPSA id A248F1F008A1; Sat, 7 Nov 2026 11:31:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794051061; bh=6sO6Askn+c0tDRxRzmc1YTbR/Q/W0yPBBIUa+eOh4bc=; h=From:To:Cc:Subject:Date; b=cwcXY8GkrspFMkD4kBPlcItLc6v7JslKarP90+cgQVyjbk8GcZ/Cn9+zxPg7xxEbI baQ3mV/sKHa1iwCtXp5kD7qDkJgGxT5Ejz/0uIsZVALoCvON62Fp3Z4jPvpzNXTNF1 URObQgc1uDPXR9qjGpYqwnupI2ozYJE7qwcJB0f3ZRqk0CKUn62dEfGR3XZS0BpkFA 4Pokmuw751dSS2zjGk2fz/ViU8C1yynDBE5/8HeIQSwBq0yAGO+se+WFcXudra+keI Iyq5XePmc3SxBwL/v1LWcx6EACzxrjmdl4J6cM64hWCxcL7lPmdLmK3extjIL8z2wL Zw3zqf0woDw7g== From: Sasha Levin To: mason@kernel.org, brauner@kernel.org Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] aio: fix NULL deref when a fault races ring truncation" failed to apply to 5.10-stable tree Date: Sat, 7 Nov 2026 06:30:59 -0500 Message-ID: <20261107063059-failed-5.10-d53b5aa5cfae@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x d53b5aa5cfae27e4d236fc0ab9581085d27f7d33 # git commit -s git send-email --to '' --in-reply-to '20261107063059-failed-5.10-d53b5aa5cfae@kernel.org' --subject-prefix 'PATCH 5.10.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From d53b5aa5cfae27e4d236fc0ab9581085d27f7d33 Mon Sep 17 00:00:00 2001 From: Chris Mason Date: Thu, 29 Oct 2026 15:00:20 +0100 Subject: [PATCH] aio: fix NULL deref when a fault races ring truncation The aio ring lives in a file on the aio pseudo filesystem and the ring VMA uses filemap_fault(). aio_ctx_aops doesn't have a ->read_folio because aio_setup_ring() puts all folios of the ring into the page cache. So a fault on the ring only works as long as it finds its folio in the page cache. If it doesn't, filemap_fault() calls ->read_folio without checking and we jump to NULL. We already fixed this twice this year. A forked child could inherit the ring mapping, fixed by commit c03ce4173c7b ("fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error"). And a partial mremap() could leave part of the ring mapped, fixed by commit 3adf7ae18bf4 ("fs: aio: reject partial mremap to avoid Null-pointer-dereference error"). Both times a VMA outlived the ring and the ring file was truncated under it. There's a third way to get there. kill_ioctx() and the error path of ioctx_alloc() unmap the ring with vm_munmap() and ignore the return value. If vm_munmap() has to wait for mmap_lock and a fatal signal is pending it returns -EINTR and the VMA stays. free_ioctx() then calls put_aio_ring_file() which truncates the ring file to zero. A fault that passed the i_size check in filemap_fault() before that doesn't find its folio anymore, allocates a new one and calls ->read_folio: fault on the ring io_destroy() with SIGKILL pending ================= ================================= vm_munmap() returns -EINTR filemap_fault() i_size check passes free_ioctx() put_aio_ring_file() truncate_setsize(inode, 0) no folio, allocate a new one filemap_read_folio() ->read_folio == NULL All that's needed is a second process that shares the mm. If a CLONE_VM child calls io_destroy() and gets SIGKILLed while it waits for mmap_lock the ring stays mapped for the threads of the parent. Any user can do that. Instead of plugging the routes one by one give the ring a ->read_folio that unlocks the folio and returns -EIO. All folios of a live ring are in the page cache so a fault can only end up there if the ring was truncated. The fault now gets SIGBUS. Nothing else reads the ring file and the aio filesystem uses noop_backing_dev_info so there's no readahead either. Making vm_munmap() unkillable in those two places would only close this one route and bring back what commit ae7987835643 ("mm: make vm_munmap killable") fixed. Fixes: 36bc08cc0170 ("fs/aio: Add support to aio ring pages migration") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-1-88f22792f6f7@kernel.org Signed-off-by: Christian Brauner (Amutable) --- fs/aio.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/aio.c b/fs/aio.c index 4f32b45cb8a0e..893db6961ad3b 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -528,7 +528,18 @@ static int aio_migrate_folio(struct address_space *mapping, struct folio *dst, #define aio_migrate_folio NULL #endif +/* + * filemap_fault() reads a folio that it did not find in the page cache. All + * folios of a live ring are there, so the ring was truncated under the fault. + */ +static int aio_read_folio(struct file *file, struct folio *folio) +{ + folio_unlock(folio); + return -EIO; +} + static const struct address_space_operations aio_ctx_aops = { + .read_folio = aio_read_folio, .dirty_folio = noop_dirty_folio, .migrate_folio = aio_migrate_folio, }; -- 2.53.0