Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [mm?] KASAN: slab-use-after-free Read in __vma_reservation_common | Date | Sun, 14 Apr 2024 07:33:41 +0800 |
| |
On Sat, 13 Apr 2024 11:34:32 -0700 > syzbot has found a reproducer for the following issue on: > > HEAD commit: 9ed46da14b9b Add linux-next specific files for 20240412 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=12bd4457180000 > kernel config: https://syzkaller.appspot.com/x/.config?x=7ea0abc478c49859 > dashboard link: https://syzkaller.appspot.com/bug?extid=ad1b592fc4483655438b > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1370ea67180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 9ed46da14b9b
--- x/mm/mmap.c +++ y/mm/mmap.c @@ -2657,8 +2657,6 @@ do_vmi_align_munmap(struct vma_iterator /* Point of no return */ mm->locked_vm -= locked_vm; mm->map_count -= count; - if (unlock) - mmap_write_downgrade(mm); prev = vma_iter_prev_range(vmi); next = vma_next(vmi); @@ -2677,7 +2675,7 @@ do_vmi_align_munmap(struct vma_iterator remove_mt(mm, &mas_detach); validate_mm(mm); if (unlock) - mmap_read_unlock(mm); + mmap_write_unlock(mm); __mt_destroy(&mt_detach); return 0; --
| |