From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-178.mta0.migadu.com (out-178.mta0.migadu.com [91.218.175.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 619DE3368BF for ; Wed, 4 Mar 2026 07:01:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772607681; cv=none; b=KFN4i5j1CPcFwW7I/UfaOQmcDI2P397IJ8Ouujgww7B5Jotg4nqxnXFgUcwmYjwnwWxRGTlYGJQU9u1ZIWX2c1koP2F4mYDo0SKh5EKLPNma1NULrtR4Lv7IlgUJWDAlqBPEZ0yNLKyRvoVRveHWNc97VoaZIE1qFCW+fvL8K+M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772607681; c=relaxed/simple; bh=4QMy2fwvlJMldVBomigoHmo0ONHV4dARz9fY68zu+ok=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZzHt8AIy+bjP4+FdZ+MfZIQ/YgtYoSRnLJhXXIH9K53fZ/O3gE6Wq5DDnHrumGL1fCyYze4cY5OygzYxku8ik1jc1Z7Lxw5NbunykAVnMXygT9Pfp1z4wgIZUbkU/I3p0jVhVJ+Z+4k26SH6tKSf1POB/RY51kFfeV45jav0O74= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=duemrzHH; arc=none smtp.client-ip=91.218.175.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="duemrzHH" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1772607677; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=vNYqlqI1PuxFEU+nd+vOm7pceggsvGmOnWy/Uj8/6+s=; b=duemrzHHbB836XiAnLu4M57k46k6UZehO61iTj1UWn+3M6gx6c+jVClvIRvisxJqsLSRq0 C5H2sPRiGnuBdxm2QpZZ6qwo3wWPRHMOwsoYiIjLZP0yH5XR6PQcn0r02zU8r3Ay/2ePB7 g0ZhOMv5f9XbFUDAWI3OPcbOP+WFWdA= From: Hui Zhu To: Andrew Morton , "Liam R . Howlett" , Lorenzo Stoakes , Vlastimil Babka , Jann Horn , Pedro Falcato , linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Hui Zhu Subject: [PATCH mm-unstable 0/2] mm/mmap: fix crashes in dup_mmap() error path Date: Wed, 4 Mar 2026 15:00:55 +0800 Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT From: Hui Zhu This series fixes two potential kernel panics in the dup_mmap() error path triggered during fork failures: Fix Use-After-Free: Moves vma_iter_free() to the end of the cleanup block to ensure the iterator remains valid during rollback. Fix NULL Dereference: Adds a check for vma_next() results to prevent crashing when the maple tree is empty. Hui Zhu (2): mm/mmap: fix Use-After-Free of vma_iterator in dup_mmap() error path mm/mmap: fix NULL pointer dereference in dup_mmap() error handling mm/mmap.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) -- 2.43.0