Re: [syzbot] linux-next boot error: WARNING in find_vma
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: 2021-08-04 10:02:29
Also in:
linux-next, lkml
Subsystem:
exec & binfmt api, elf, filesystems (vfs and infrastructure), security subsystem, the rest, tomoyo security module · Maintainers:
Kees Cook, Alexander Viro, Christian Brauner, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds, Kentaro Takeda, Tetsuo Handa
On 2021/08/04 5:24, Andrew Morton wrote:
Thanks. I'm suspecting "Add mmap_assert_locked() annotations to find_vma*()" found an error in Tomoyo - tomoyo_dump_page() should be holding mmap_lock?
Yes, TOMOYO needs the same protection which get_arg_page() needs. Please fold below diff into "mm/pagemap: add mmap_assert_locked() annotations to find_vma*()".
diff --git a/fs/exec.c b/fs/exec.c
index 816c7e347c9c..c982de69fab9 100644
--- a/fs/exec.c
+++ b/fs/exec.c@@ -214,8 +214,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, gup_flags |= FOLL_WRITE; /* - * We are doing an exec(). 'current' is the process - * doing the exec and bprm->mm is the new process's mm. + * We are doing an exec(). bprm->mm is the new process's mm. */ mmap_read_lock(bprm->mm); ret = get_user_pages_remote(bprm->mm, pos, 1, gup_flags,
diff --git a/security/tomoyo/domain.c b/security/tomoyo/domain.c
index 98d985895ec8..31af29f669d2 100644
--- a/security/tomoyo/domain.c
+++ b/security/tomoyo/domain.c@@ -897,6 +897,9 @@ bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, struct tomoyo_page_dump *dump) { struct page *page; +#ifdef CONFIG_MMU + int ret; +#endif /* dump->data is released by tomoyo_find_next_domain(). */ if (!dump->data) {
@@ -909,11 +912,13 @@ bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, /* * This is called at execve() time in order to dig around * in the argv/environment of the new proceess - * (represented by bprm). 'current' is the process doing - * the execve(). + * (represented by bprm). */ - if (get_user_pages_remote(bprm->mm, pos, 1, - FOLL_FORCE, &page, NULL, NULL) <= 0) + mmap_read_lock(bprm->mm); + ret = get_user_pages_remote(bprm->mm, pos, 1, + FOLL_FORCE, &page, NULL, NULL); + mmap_read_unlock(bprm->mm); + if (ret <= 0) return false; #else page = bprm->page[pos / PAGE_SIZE];