Matthew, On Thu, Oct 03, 2024 at 09:31:17PM +0100, Matthew Wilcox wrote: > On Thu, Oct 03, 2024 at 09:31:06PM +0530, Manas via B4 Relay wrote: > > From: Manas <manas18244@xxxxxxxxxxx> > > > > syzbot has pointed to a possible null pointer dereference in > > pfnmap_lockdep_assert. vm_file member of vm_area_struct is being > > dereferenced without any checks. > > > > This fix returns if vm_file member in vm_area_struct is NULL. > > This seems like the wrong fix. It's mmap'ing a file, so vm_file should > not be NULL. Or have I forgotten something very important about how the > MM works? If I read the stack right, the crash was before mmap() of the new vma happens, instead it's during unmap() of one existing vma which existed and overlapped with the new vma's mapping range: follow_phys arch/x86/mm/pat/memtype.c:956 [inline] get_pat_info+0x182/0x3f0 arch/x86/mm/pat/memtype.c:988 untrack_pfn+0x327/0x640 arch/x86/mm/pat/memtype.c:1101 unmap_single_vma+0x1f6/0x2b0 mm/memory.c:1834 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1900 unmap_region+0x214/0x380 mm/vma.c:354 <--------------- here mmap_region+0x22f9/0x2990 mm/mmap.c:1573 do_mmap+0x8f0/0x1000 mm/mmap.c:496 vm_mmap_pgoff+0x1dd/0x3d0 mm/util.c:588 ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:542 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f It looks like the vma that was overwritten by the new file vma mapping could be a VM_PFNMAP vma (I'm guessing vvar or something similar..), that's where untrack_pfn() got kicked off. In this case, the vma being overwritten and to be unmapped can have ->vm_file==NULL (while ->vm_ops non-NULL; /me looking at __install_special_mapping()). Thanks, -- Peter Xu
