Re: [PATCH v6 7/8] fs/proc/task_mmu: read proc/pid/maps under per-vma lock

[Hillf Danton <hdanton@sina.com>]

On Thu, 10 Jul 2025 19:42:16 +0200  Vlastimil Babka wrote:
> On 7/10/25 19:02, Suren Baghdasaryan wrote:
> > On Thu, Jul 10, 2025 at 12:03 AM Suren Baghdasaryan <surenb@google.com> wrote:
> >>
> >>
> >> I have the patchset ready but would like to test it some more. Will
> >> post it tomorrow.
> > 
> > Ok, I found a couple of issues using the syzbot reproducer [1] (which
> > is awesome BTW!):
> > 1. rwsem_acquire_read() inside vma_start_read() at [2] should be moved
> > after the last check, otherwise the lock is considered taken on
> > vma->vm_refcnt overflow;
> > 2. query_matching_vma() is missing unlock_vma() call when it does
> > "goto next_vma;" and re-issues query_vma_find_by_addr(). The previous
> > vma is left locked;
> 
> How does that happen? query_vma_find_by_addr() does get_next_vma() which
> does unlock_vma()?
> 
Adding a mutex that protects do_procmap_query() survived the syzbot test [1,2].
That sounds like a bad news as locking vma alone is not enough to query the map.

[1] https://lore.kernel.org/lkml/687092d6.a00a0220.26a83e.0036.GAE@google.com/
[2] https://lore.kernel.org/lkml/6870a4a4.a00a0220.26a83e.003c.GAE@google.com/