archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:44:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/fs/proc
History
Andrii Nakryiko b5cbacd7f8 procfs: avoid fetching build ID while holding VMA lock 
Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock
or per-VMA lock, whichever was used to lock VMA under question, to avoid
deadlock reported by syzbot:

 -> #1 (&mm->mmap_lock){++++}-{4:4}:
        __might_fault+0xed/0x170
        _copy_to_iter+0x118/0x1720
        copy_page_to_iter+0x12d/0x1e0
        filemap_read+0x720/0x10a0
        blkdev_read_iter+0x2b5/0x4e0
        vfs_read+0x7f4/0xae0
        ksys_read+0x12a/0x250
        do_syscall_64+0xcb/0xf80
        entry_SYSCALL_64_after_hwframe+0x77/0x7f

 -> #0 (&sb->s_type->i_mutex_key#8){++++}-{4:4}:
        __lock_acquire+0x1509/0x26d0
        lock_acquire+0x185/0x340
        down_read+0x98/0x490
        blkdev_read_iter+0x2a7/0x4e0
        __kernel_read+0x39a/0xa90
        freader_fetch+0x1d5/0xa80
        __build_id_parse.isra.0+0xea/0x6a0
        do_procmap_query+0xd75/0x1050
        procfs_procmap_ioctl+0x7a/0xb0
        __x64_sys_ioctl+0x18e/0x210
        do_syscall_64+0xcb/0xf80
        entry_SYSCALL_64_after_hwframe+0x77/0x7f

 other info that might help us debug this:

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   rlock(&mm->mmap_lock);
                                lock(&sb->s_type->i_mutex_key#8);
                                lock(&mm->mmap_lock);
   rlock(&sb->s_type->i_mutex_key#8);

  *** DEADLOCK ***

This seems to be exacerbated (as we haven't seen these syzbot reports
before that) by the recent:

	777a8560fd ("lib/buildid: use __kernel_read() for sleepable context")

To make this safe, we need to grab file refcount while VMA is still locked, but
other than that everything is pretty straightforward. Internal build_id_parse()
API assumes VMA is passed, but it only needs the underlying file reference, so
just add another variant build_id_parse_file() that expects file passed
directly.

[akpm@linux-foundation.org: fix up kerneldoc]
Link: https://lkml.kernel.org/r/20260129215340.3742283-1-andrii@kernel.org
Fixes: ed5d583a88 ("fs/procfs: implement efficient VMA querying API for /proc/<pid>/maps")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reported-by: <syzbot+4e70c8e0a2017b432f7a@syzkaller.appspotmail.com>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Tested-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Hao Luo <haoluo@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@kernel.org>
Cc: Martin KaFai Lau <martin.lau@linux.dev>
Cc: Song Liu <song@kernel.org>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Yonghong Song <yonghong.song@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-02-05 14:10:00 -08:00
..
array.c seqlock, procfs: Match scoped_seqlock_read() critical section vs. RCU ordering in do_task_stat() to do_io_accounting() 2025-12-02 11:21:07 +01:00
base.c Some filesystems use a kinda-sorta controlled dentry refcount leak to pin 2025-12-05 14:36:21 -08:00
bootconfig.c fs/proc: Skip bootloader comment if no embedded kernel parameters 2024-04-09 23:36:18 +09:00
cmdline.c proc: mark /proc/cmdline as permanent 2023-02-02 22:50:02 -08:00
consoles.c proc: Add nbcon support for /proc/consoles 2024-09-04 15:56:33 +02:00
cpuinfo.c x86/aperfmperf: Replace aperfmperf_get_khz() 2022-04-27 20:22:19 +02:00
devices.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
fd.c proc_fd_getattr(): don't bother with S_ISDIR() check 2025-06-16 16:21:07 +02:00
fd.h fs: port ->permission() to pass mnt_idmap 2023-01-19 09:24:28 +01:00
generic.c fs/proc: fix uaf in proc_readdir_de() 2025-11-09 21:19:43 -08:00
inode.c fs/proc: replace "__auto_type" with "const auto" 2025-12-08 15:32:15 -08:00
internal.h procfs: make /self and /thread_self dentries persistent 2025-11-16 01:35:02 -05:00
interrupts.c fs/procfs: Switch to irq_get_nr_irqs() 2024-10-16 21:56:59 +02:00
Kconfig virtio-mem: support CONFIG_PROC_VMCORE_DEVICE_RAM 2025-01-27 09:39:25 -05:00
kcore.c crash: Use note name macros 2025-02-10 16:56:58 -08:00
kmsg.c printk changes for 6.1 2022-10-10 11:24:19 -07:00
loadavg.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
Makefile kbuild: make -Woverride-init warnings more consistent 2024-03-31 11:32:26 +09:00
meminfo.c mm, vmstat: remove the NR_WRITEBACK_TEMP node_stat_item counter 2025-07-19 18:59:47 -07:00
namespaces.c fs/proc/namespaces: make ns_entries const 2025-09-15 14:28:37 +02:00
nommu.c fs: create helper file_user_path() for user displayed mapped file path 2023-10-19 11:03:15 +02:00
page.c fs/proc/page: remove unused KPMBITS 2025-11-20 14:03:42 -08:00
proc_net.c fs: Add kernel-doc comments to proc_create_net_data_write() 2024-03-26 09:01:18 +01:00
proc_sysctl.c Current exclusion rules for ->d_flags stores are rather unpleasant. 2025-07-28 09:17:57 -07:00
proc_tty.c proc: delete unused <linux/uaccess.h> includes 2022-07-17 17:31:39 -07:00
root.c procfs: make /self and /thread_self dentries persistent 2025-11-16 01:35:02 -05:00
self.c procfs: make /self and /thread_self dentries persistent 2025-11-16 01:35:02 -05:00
softirqs.c proc/softirqs: replace seq_printf with seq_put_decimal_ull_width 2024-11-07 07:40:14 -10:00
stat.c fs/procfs: Switch to irq_get_nr_irqs() 2024-10-16 21:56:59 +02:00
task_mmu.c procfs: avoid fetching build ID while holding VMA lock 2026-02-05 14:10:00 -08:00
task_nommu.c fs/proc/task_mmu: factor out proc_maps_private fields used by PROCMAP_QUERY 2025-09-13 16:54:48 -07:00
thread_self.c procfs: make /self and /thread_self dentries persistent 2025-11-16 01:35:02 -05:00
uptime.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
util.c
version.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
vmcore.c fs/proc/vmcore: a few cleanups for vmcore_add_device_dump() 2025-07-09 22:57:56 -07:00