From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail115-76.sinamail.sina.com.cn (mail115-76.sinamail.sina.com.cn [218.30.115.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 494912119 for ; Wed, 1 Jan 2025 06:52:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=218.30.115.76 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735714353; cv=none; b=O9BFzXHoI1mOYpKB/MF2AwFBQnQsiNG1blEk98SlJDKW/df/3eWzVvjMWJAkARKeQvz10XNQylSjcQU0IK3KkMmdD+17rhWUsHnUvFmb8JiQhHGomgTVhRz5YwFSyT7scADrfI2N3gamF0sxtvtdDdNnDfC/A/PT8UGnMXC8HXg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735714353; c=relaxed/simple; bh=5JM098JG1FmwTEsnpkcMg6BZnWNFF8wvcRzF8XKeHT0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=j7AXZY0anWIhdSbgspKwuzd7kjaOSk92eJQwu950VZBMyo6c6VGd9HYV4eQrlTJMrOJUIhTeDXRVrej/02+EiMg+bbwNdRDNxjlirGVfRNg5ekuDw8rGMX8SROYPg8OMnxIoxanUkgbI2F+BagRjDg0AzoMqEaARxDzHSxbPL4U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; arc=none smtp.client-ip=218.30.115.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([116.24.8.141]) by sina.com (10.185.250.22) with ESMTP id 6774E5930000382E; Wed, 1 Jan 2025 14:50:00 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 2104687602642 X-SMAIL-UIID: 9F6D42E119F142E6958A7BDBA40FA817-20250101-145000-1 From: Hillf Danton To: syzbot Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [mm?] [xfs?] KASAN: slab-use-after-free Read in filemap_map_pages Date: Wed, 1 Jan 2025 14:49:59 +0800 Message-ID: <20250101065000.1243-1-hdanton@sina.com> In-Reply-To: <6774bf44.050a0220.25abdd.098a.GAE@google.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Tue, 31 Dec 2024 20:06:28 -0800 > syzbot found the following issue on: > > HEAD commit: 8155b4ef3466 Add linux-next specific files for 20241220 > git tree: linux-next > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ed90b0580000 #syz test --- x/mm/filemap.c +++ y/mm/filemap.c @@ -3703,6 +3703,7 @@ vm_fault_t filemap_map_pages(struct vm_f struct address_space *mapping = file->f_mapping; pgoff_t file_end, last_pgoff = start_pgoff; unsigned long addr; + unsigned long pmd_end; XA_STATE(xas, &mapping->i_pages, start_pgoff); struct folio *folio; vm_fault_t ret = 0; @@ -3731,6 +3732,11 @@ vm_fault_t filemap_map_pages(struct vm_f if (end_pgoff > file_end) end_pgoff = file_end; + pmd_end = ALIGN(addr, PMD_SIZE); + pmd_end = (pmd_end - addr) >> PAGE_SHIFT; + if (end_pgoff - start_pgoff > pmd_end) + end_pgoff = start_pgoff + pmd_end; + folio_type = mm_counter_file(folio); do { unsigned long end; --