From: Eric W. Biederman <ebiederm@xxxxxxxxxxxx> commit 49c1866348f364478a0c4d3dd13fd08bb82d3a5b upstream. The condition is impossible and to the best of my knowledge has never triggered. We are in deep trouble if that conditions happens and we walk past the end of our allocated array. So delete the WARN_ON and the code that makes it look like the kernel can handle the case of walking past the end of it's vma_meta array. Reviewed-by: Jann Horn <jannh@xxxxxxxxxx> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/coredump.c | 5 ----- 1 file changed, 5 deletions(-) --- a/fs/coredump.c +++ b/fs/coredump.c @@ -1123,11 +1123,6 @@ int dump_vma_snapshot(struct coredump_pa mmap_write_unlock(mm); - if (WARN_ON(i != *vma_count)) { - kvfree(*vma_meta); - return -EFAULT; - } - for (i = 0; i < *vma_count; i++) { struct core_vma_metadata *m = (*vma_meta) + i; Patches currently in stable-queue which might be from ebiederm@xxxxxxxxxxxx are queue-5.10/ptrace-check-ptrace_o_suspend_seccomp-permission-on-ptrace_seize.patch queue-5.10/coredump-remove-the-warn_on-in-dump_vma_snapshot.patch queue-5.10/exec-force-single-empty-string-when-argv-is-empty.patch