Re: [syzbot] [mm?] KASAN: slab-use-after-free Read in mas_walk

[Hillf Danton <hdanton@sina.com>]

> Date: Thu, 12 Feb 2026 11:22:34 -0800	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    192c0159402e Merge tag 'powerpc-7.0-1' of git://git.kernel..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1304cc02580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=aaa1d655bee4457b
> dashboard link: https://syzkaller.appspot.com/bug?extid=54245a237762e7cbecf0
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13d40ffa580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1704cc02580000

Test tglx's fix.

#syz test

--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -780,7 +780,7 @@ static int do_procmap_query(struct mm_st
 		} else {
 			if (karg.build_id_size < build_id_sz) {
 				err = -ENAMETOOLONG;
-				goto out;
+				goto out_file;
 			}
 			karg.build_id_size = build_id_sz;
 		}
@@ -808,6 +808,7 @@ static int do_procmap_query(struct mm_st
 out:
 	query_vma_teardown(&lock_ctx);
 	mmput(mm);
+out_file:
 	if (vm_file)
 		fput(vm_file);
 	kfree(name_buf);
--