From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f170.google.com (mail-qt1-f170.google.com [209.85.160.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24BB047799F for ; Wed, 27 May 2026 18:14:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779905647; cv=none; b=qAPmQous7j5BrCmnLo8ocsUwOoX8+B2QBRkF1bA0QG9smaIozLOE+m2F17t/mNbyY3xFLY0RJ0mdK844BZiW7gZT7kNOVhHBawVABWfJH4fVZ2VfPQsypOUR616JGIEkPO1Ir3VPPk7W97TTcti6mcCR2pqDBnIWWLRkd+Jv9z8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779905647; c=relaxed/simple; bh=uGZ7H4aV3vxtZ+xJN8Py/enUKlVbHMsM212d+tEWun4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=RpvAAif9JU0PJvU0Bemo1l0dp6ZY3KmJbx4rukTcH3KBBV69tuXaXSwspi0dR1N4NHqU2DTaxuLBhY8rUFMTRwXl+THE98wibuEyOMvXpNZQjZ6ihBZ6QNu7+BNnr0pQIqXz5zF5WNFN0YqctVd+aFxLPg+3AtZyFDJXWWEUV9M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=gourry.net; spf=pass smtp.mailfrom=gourry.net; dkim=pass (2048-bit key) header.d=gourry.net header.i=@gourry.net header.b=oyNpkINc; arc=none smtp.client-ip=209.85.160.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=gourry.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gourry.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gourry.net header.i=@gourry.net header.b="oyNpkINc" Received: by mail-qt1-f170.google.com with SMTP id d75a77b69052e-50fc496c8baso133326631cf.3 for ; Wed, 27 May 2026 11:14:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gourry.net; s=google; t=1779905644; x=1780510444; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=LwEpKAm2YrkE7cJAsX+WvqoYg3SlwB6svvqQQHAzIiI=; b=oyNpkINcgDR8NcGQlPa4o9e4RUO9an9N1kuGt9Z7j8C2Cy6eOIs/Pl8wZRYx3LKUxf MrDT51WZunU8VtxTOw098hNQ/1IQjAYZJrfk/n8NNBDcjFeGyxFcHA5rysyTm8oBlMJ9 jWTu3iJeg34jjpyKvIK1eU5XEuEIHzrdrLhUs9+OyOqzq/WlJohKhVz0Ax2/1X3d83oP XTgaA25CSXbGtYK+933/+UBETxqtX+ILFyp+WAMbeuEUpEB244a1HEbZcCcdAvZktYBf NhEqcQ5CZFAxTAZXW0Qx4GIlB0Diy9W0lwJ3nS1+WzCiwKlToADvjHmXzpQ0vJTNsgrm oQYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779905644; x=1780510444; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LwEpKAm2YrkE7cJAsX+WvqoYg3SlwB6svvqQQHAzIiI=; b=kYc0QH1yIRxZGckPCMmy7VJhemM+y5a/w1VEFfjW9I+LjhLyTW5c38oF7kDFxHlA5E 1/ekZWstqUXEAyqF1t6vf0novPiIiCh0U5KATPsxE5aQn9aOUvfGJXpeYDep2okez7Jk cDDLxOSgBbBrKdCFBytMeAExgbixLR/pZx/pnT990Z7oe5apyLI8mtZFl4FiAzQXaHQk CBLvCW+bE3+DfO9rb5c5YpxeP11+eD7HTbftB7AWA0DrvwohzaoRYVHdmt1GeajWLx0F D+4z1weJO+niBbGxq161UILj25N2qQ8lLtrsRU0VWfD1FCWV3Qe996e3Iqf8R60pyDS9 zaqQ== X-Forwarded-Encrypted: i=1; AFNElJ9z2k6LtIJYfgwASP0A9UBa2jXPb2S6b9o4RuVQ3WP7GHT2YwCM5oa8ivUuTq6SrGPqH9t4ZO+Rff5IlpA=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1Q+pjT4VkT38DWEuoNILUlNUS9NdAZTN6KtwT1v/J/grj25WO 8ealysXNBfq8uckJojZ1KOle4GEuiA8cmC4YejKjqbOpA8rDw2RfQYTnNQOV3LFWA5c= X-Gm-Gg: Acq92OEAR3Z31+ySQuQElFBvwQIn5ePiKstyc/XB0o61qouzZJpOyKdiIF3jUHUdtqJ KDK5xT6GIsAZ/TZvIIIakCgEQZFLTyVWGYhl5ncEeDjLFuvGYhWiIDPzrp4XhB9+1oDzSJkbCQW Z//cV00JujGZn5WFA433L0sQhzzsEzRlrwiV7+s/Hr9of9CXsMES/PfTmjv9+cMZ2VBGFxcGAwO 5ogm4pVPaUX9EgfWvsxpUKnjtwvGIvPA5keaOKI5cZ1FgVgV36ewwERHZJ2miP3gZnJF/tGmesC vRvnr4wr0iydsMoDb9SuWkPkxh2wCuBODvMJZZao2lyQzOqW24XoMFTYkuyf0fGrZFZekhdRarY JAPDD+6SVxEzzsPqVsBpIajTqAoXYWk5jg99O9mwzGm/G9H+oL3R75ZDBcV558DlnVLs3yCXVWY loP4B3VP2kriVhhPHf/sU1Lt1zxIv8C6rPgzO4RjMwat8Ks42dHswmWRT36F5AJKnw9HGbEBSe+ MFWKGGp0SDqdv3yt2rQBXXcmpZUlHMyjw== X-Received: by 2002:a05:622a:5c1a:b0:516:d66e:7b20 with SMTP id d75a77b69052e-516d66ec055mr308788571cf.36.1779905643537; Wed, 27 May 2026 11:14:03 -0700 (PDT) Received: from gourry-fedora-PF4VCD3F (pool-100-36-248-188.washdc.fios.verizon.net. [100.36.248.188]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51706af43aesm49228561cf.24.2026.05.27.11.14.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 May 2026 11:14:03 -0700 (PDT) Date: Wed, 27 May 2026 14:14:01 -0400 From: Gregory Price To: Oleg Nesterov Cc: Alistair Popple , Andrew Morton , Byungchul Park , David Hildenbrand , Joshua Hahn , Matthew Brost , Rakie Kim , Ying Huang , Zi Yan , Jann Horn , Kees Cook , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm/migrate: find_mm_struct: fix race between security checks and suid exec Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, May 26, 2026 at 04:42:11PM +0200, Oleg Nesterov wrote: > The target task can execute a setuid binary between ptrace_may_access() > and get_task_mm(). Protect this critical section with exec_update_lock. > > I don't think cpuset_mems_allowed(task) should be called under > exec_update_lock, but this patch just tries to add the minimal fix. > Claude suggests this is at least safe and the correct ordering, for which there already exists code that does the same thing: This ordering already exists in the exec path itself: exec_mmap() write-locks exec_update_lock, and subsequent memory allocations during exec can reach callback_lock through the page allocator's cpuset checks (cpuset_zone_allowed etc.). This is inline with my experience hacking on page_alloc.c and cgroups, the callback lock is always the inner-most lock - so lgtm. > Perhaps we can later add a common helper which can be used by > find_mm_struct() and kernel_migrate_pages(). > > Signed-off-by: Oleg Nesterov Reviewed-by: Gregory Price ~Gregory