From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.222.176 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794507100; b=QK0yzyMQUumKJNpP/EGkCMUVmvF3spUPUC3qt75I6hf/4i4bZeAU6RHGPSayMJMrtOJn 9aKFyBct6nMABmLPQ6ZDBIZf5grvPN5QSe3sft08z5dCMZE1jyVBJvjGpS7ARHVa1Ag42 9FRfYjKj1mk4xm6HfJLtaj81LCQpNuz2muJMUIfoIeiUW9ptYnDROMANE3MkB8YduQK2/ ED8iDOHpgqxl7KsnF3nBWlFPUh4fYr4UfZ0tF5jp+T+OeOxNfPVETadnf7M9DmAuwFqfV TrCsrRt84CkUbo3zTGnYRNv0tdQPwUzAb1p2AxLWJP0sHRu/1kNcULBcYji7ndh6G9g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794507100; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: MIME-Version:Content-Type:Content-Transfer-Encoding:Subject:From:To: Cc:In-Reply-To:References:Date:Message-Id:X-Mailer; bh=vbhDJD4+BQC4thd2CH24LWDde1jZ/0BhOjMBI9uZ0t8=; b=EUcaTtVFN2QGsEk8LPc0jAjd+utKSV7pnbro507AboIWSIifIfLh1gpdXScSPZby2Ngc bWPx10GxMMk316eFuIx+9v+Kg7v6ee1Od1BsmE1pb8EBCcX1enyHuMTN7Vs9oktb/7q/P 0XzMdKfdiosIj18q0x+B/sKJFzdu0mIOiUAJ54Yx5PADpcIigPZSuGJBzc3sCO6WdMFY+ htuwLtmSnKwUC0ii1RwM1OEaxoMij5QjT7OnQWw0agxmegaHRJBO7826prtbQN4ZJtW/o c7aoNoNXB8r2W6hdul7299e+eQhY49qAHPlMWnYJdSOe8adF5kROyuKhzjLi2739USQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none header.from=gourry.net; spf=pass smtp.mailfrom=gourry.net; dkim=pass header.d=gourry.net header.i=@gourry.net header.a=rsa-sha256 header.s=google header.b=M+YUKf86; arc=none smtp.remote-ip=209.85.222.176 Received: from mail-qk1-f176.google.com (mail-qk1-f176.google.com [209.85.222.176]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D995606A31C for ; Thu, 12 Nov 2026 18:11:40 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 3D995606A31C Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=gourry.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gourry.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gourry.net header.i=@gourry.net header.a=rsa-sha256 header.s=google header.b=M+YUKf86 Received: by mail-qk1-f176.google.com with SMTP id af79cd13be357-93e635220b4so1602885a.1 for ; Thu, 12 Nov 2026 10:11:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gourry.net; s=google; t=1794507099; x=1795111899; darn=vger.kernel.org; h=message-id:date:references:in-reply-to:cc:to:from:subject :content-transfer-encoding:content-type:mime-version:from:to:cc :subject:date:message-id:reply-to:content-type; bh=vbhDJD4+BQC4thd2CH24LWDde1jZ/0BhOjMBI9uZ0t8=; b=M+YUKf86JBPSifV9KHZNo/IxkhlariouSze/wFvYmxecLP4M+6xAZUhrMz8gE2MYHO lYJ49kyJas62Vgxh4zG1raIwc9fO2zqjj7bJz+BNADsw6yR4eLA38ko27KzlYs3Vpy0y UeDHfXAx7Tugez+dsbekHeJIex+zCllOcxf0v070kEeCohrpccAuYuwq4oubwcUfhVGb m4ExPq/MTUzCs9adjOmKOJpRMD+Z4DgmQXD6QdMV8OyBgqBXTYzOV7QiruZECqK/4xt7 BoXXHg6uHdXiLuxrua+v0stzvXViN1wB/1q/3QErXiw5TKlV38h9pHDcTC+3HnbBwoxo Z7UQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794507099; x=1795111899; h=message-id:date:references:in-reply-to:cc:to:from:subject :content-transfer-encoding:content-type:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=vbhDJD4+BQC4thd2CH24LWDde1jZ/0BhOjMBI9uZ0t8=; b=jMc7jC/CxTS9Gbl2cJWL0u/w4Ki8PjQjAPrhvRn48NHLzup1XN2zLCrBL4nwyGDLOC 7IkqiEaZL2YRpD1j4oJ/gpFIbPTLmWuo9WW4XiPdcVpCHmXC0MmIG24+3XA6u+2pWwTo NSuaMiyufYTSmZIguCKLu3JRjUz7nF6vwCyJ46KlqSPQnt0Xrn2mjNLLp5IL7tbiIr1E T02FHV6ioxLF1fL5M5k4uIq8jRGmu2bH+vzHEjQiBGRZpRFONSbE5sjBdiMXX1RsYHHO BSVCKz6MgEBIB/o2MqPEA3Wf414dydnqWC3mLJy2C+p6b7+TKTZ17hYGcFeGiF/6klR5 zArw== X-Forwarded-Encrypted: i=1; AL+hErH/eSLQBEQSIHbAe1nzAM/gWl7J2L+/sZAHjyOFKoGc6sLrY+cvRkhhwnMWmsNa+WaRi2pXtTZz6U1DT+M=@vger.kernel.org X-Gm-Message-State: APuU4Z/gEbLVOwKoQQfnj/4mEg8pxqMfq3NDucHg/4N/+z/xldmVfEov Rg/wH4Pi/5kwyoqJhQBZFW7LGxYgqsae1lFb7eI/PT+WTXR3izBH0gBuzlBGw0dmZlk= X-Gm-Gg: AYBFou3mLue8hVv3jPynaXX0tBuaqr/UPKfo1MvRiY4VuhzdfsYNBpuoDz8c2IamYzQ Dggm5F9Q6N/LXOaXdqZcF5i1ruXoJdZdvB6XNqbjptxu3Srg4Nsaoua992zzNDeSpe2di4ZjrHn EUxpvrY3FEnlCQICrDtxdsGM2mwezwNDtxDgEQc8alSNAChGryihH04Zypc6JkSqV0Dx+UB0D2w Iu6zYBWETLE8urceGQepBvFrFVSYE+3NwWLQcmW/4frZqsq8Td+11atj34JvYlWVPcGtaok01WW FT3qPWq7gO8cO++KVfdLs8o5vwPsROgf0vl25RvFjMKHnZ8AIiNIaDE0s2r7SF19UkJ91oLa02P Sb7vm977NgxlTqErqmN9BdQXES26K2+qfc1yVmLVTyXUY7Hm6tcMY9YwtlLiOnGqYPaTyBNvwHB o/SpB2t5VspTXkJjZ9z/Gkp5kxlmSba7GBrWFugdSh4S0wLI7UuZmNvHvstze4ZTKAkrWOc8AJ4 twSL2ry3bqiSWJigusIUOKJ/a5UIxQZRg3fA96+rqLY1zz6Pde0n1DkyTicTS1kkepwgkC72fZB 2qJYP4abLl8OwhhY9UC6Shb6swV1w8fsvHNEYsH4RGdyDAdPzViH3aN2spuHsLyJrbhwCvbAdbQ ASEnz7Q0= X-Received: by 2002:a05:620a:410e:b0:93e:c12c:fbc4 with SMTP id af79cd13be357-9494bcaf24cmr27719385a.81.1794507098958; Thu, 12 Nov 2026 10:11:38 -0800 (PST) Received: from [192.168.50.231] (pool-71-191-145-202.washdc.fios.verizon.net. [71.191.145.202]) by smtp.gmail.com with ESMTPSA id af79cd13be357-9479e7845fasm776538885a.18.2026.11.12.10.11.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Nov 2026 10:11:38 -0800 (PST) X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Subject: Re: [PATCH 09/13] mm/migrate_device: fix use-after-free of the anon rmap From: "Gregory Price (Meta)" To: "Lorenzo Stoakes (ARM)" Cc: David Hildenbrand , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , David Rientjes , Shakeel Butt , Andrew Morton , Jann Horn , Pedro Falcato , "Matthew Wilcox (Oracle)" , Jan Kara , Nhat Pham , Johannes Weiner , Zi Yan , Matthew Brost , Joshua Hahn , Byungchul Park , Gregory Price , Ying Huang , Alistair Popple , Usama Arif , Kairui Song , Balbir Singh , =?utf-8?q?J=C3=A9r=C3=B4me_Glisse?= , Kiryl Shutsemau , Yu-cheng Yu , Dave Hansen , Dennis Zhou , Tejun Heo , Christoph Lameter , Peng Fan , Josef Bacik , Chris Mason , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, "Borislav Petkov (AMD)" , Mark Brown , "Dennis Zhou (Facebook)" , Rick Edgecombe , stable@vger.kernel.org In-Reply-To: <20261111-mason-migrate-et-al-fixes-v1-9-3d2454362e8d@kernel.org> References: <20261111-mason-migrate-et-al-fixes-v1-0-3d2454362e8d@kernel.org> <20261111-mason-migrate-et-al-fixes-v1-9-3d2454362e8d@kernel.org> Date: Thu, 12 Nov 2026 13:11:36 -0500 Message-Id: <179450709690.482102.6960491372735414259.b4-reply@b4> X-Mailer: b4 0.17-dev On 2026-11-11 18:13 +0000, Lorenzo Stoakes (ARM) wrote: > A munmap() of anonymous memory can result in a use-after-free of the > anonymous rmap if a concurrent device memory migration occurs and the > migration runs without the mmap_lock held. > > This can occur for a long-term pin of device-coherent memory, or a driver > evicting its device memory by PFN. > > Consider: > > eviction munmap() > ======== ======== > migrate_device_range() > migrate_device_unmap() > try_to_migrate() > zap the migration entry > unlink_anon_vmas() > last VMA: free the anon_vma > migrate_device_finalize() > remove_migration_ptes() > /* locks and walks the freed anon_vma */ > > If munmap() runs before try_to_migrate() instead, the folio is no longer > mapped and gets no migration entry. The walk still runs, and follows the > stale folio->mapping to the freed anon_vma. > > Resolve this by pinning the anon rmap of each folio which possesses one in > migrate_device_range(), migrate_device_pfns() and > migrate_device_coherent_folio() before its PTEs are replaced, and > unpinning it once the walk is done. > > A folio which is no longer mapped cannot be pinned and has no migration > entries to remove, so skip it rather than migrating it. > > Reported-by: Chris Mason > Fixes: e778406b40db ("mm/migrate_device.c: add migrate_device_range()") > Cc: > Signed-off-by: Lorenzo Stoakes (ARM) Was able to reproduce/observe a slab-UAF in rmap_walk_anon with KASAN enabled, and that this patch resolves it. Can't say i understand the change well enough to R-by, but I can say this resolves a clear bug. Tested-by: Gregory Price (Meta) -- ~Gregory