Re: [PATCH] mm/madvise: handle madvise_lock() failure during race unwinding

[Lorenzo Stoakes]

On Mon, Jun 02, 2025 at 09:20:14PM +0200, Jann Horn wrote:
> @akpm FYI, this looks like it fixes a security bug in 6.15 (probably
> leads to UAF of VMA structs and page tables by racing madvise(...,
> MADV_GUARD_INSTALL) with concurrent faults)

Hmm MADV_GUARD_INSTALL / MADV_GUARD_REMOVE require only a read lock, so
madvise_lock() will be:


	if (madvise_need_mmap_write(behavior)) { <--- nope
		if (mmap_write_lock_killable(mm))
			return -EINTR;
	} else {
		mmap_read_lock(mm); <---- this branch
	}
	return 0;

So for guard install, which is the only thing that can return -ERESTARTNOINTR
madvise_lock() ignoring the return value is essentially a no-op no?

Am I missing something?

>
> On Mon, Jun 2, 2025 at 7:49 PM SeongJae Park <sj@xxxxxxxxxx> wrote:
> > When unwinding race on -ERESTARTNOINTR handling of process_madvise(),
> > madvise_lock() failure is ignored.  Check the failure and abort
> > remaining works in the case.
> >
> > Fixes: 4000e3d0a367 ("mm/madvise: remove redundant mmap_lock operations from process_madvise()")
> > Cc: stable@xxxxxxxxxx
> > Reported-by: Barry Song <21cnbao@xxxxxxxxx>
> > Closes: https://lore.kernel.org/CAGsJ_4xJXXO0G+4BizhohSZ4yDteziPw43_uF8nPXPWxUVChzw@xxxxxxxxxxxxxx
> > Signed-off-by: SeongJae Park <sj@xxxxxxxxxx>
>
> Reviewed-by: Jann Horn <jannh@xxxxxxxxxx>