[PATCH] mm/vma: fix memory leak in __mmap_region()

[PATCH] mm/vma: fix memory leak in __mmap_region()

[Sechang Lim]

commit 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare
swaps the file") handled the success path by skipping get_file() via
file_doesnt_need_get, but missed the error path.

When /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls
shmem_zero_setup_desc() which allocates a new shmem file to back the
mapping. If __mmap_new_vma() subsequently fails, this replacement
file is never fput()'d - the original is released by
ksys_mmap_pgoff(), but nobody releases the new one.

Add fput() for the swapped file in the error path.

Reproducible with fault injection.

FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x164/0x1f0
 should_fail_ex+0x525/0x650
 should_failslab+0xdf/0x140
 kmem_cache_alloc_noprof+0x78/0x630
 vm_area_alloc+0x24/0x160
 __mmap_region+0xf6b/0x2660
 mmap_region+0x2eb/0x3a0
 do_mmap+0xc79/0x1240
 vm_mmap_pgoff+0x252/0x4c0
 ksys_mmap_pgoff+0xf8/0x120
 __x64_sys_mmap+0x12a/0x190
 do_syscall_64+0xa9/0x580
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>

kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
BUG: memory leak
unreferenced object 0xffff8881118aca80 (size 360):
  comm "syz.7.14", pid 366, jiffies 4294913255
  hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
    ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff  .........(M.....
  backtrace (crc db0f53bc):
    kmem_cache_alloc_noprof+0x3ab/0x630
    alloc_empty_file+0x5a/0x1e0
    alloc_file_pseudo+0x135/0x220
    __shmem_file_setup+0x274/0x420
    shmem_zero_setup_desc+0x9c/0x170
    mmap_zero_prepare+0x123/0x140
    __mmap_region+0xdda/0x2660
    mmap_region+0x2eb/0x3a0
    do_mmap+0xc79/0x1240
    vm_mmap_pgoff+0x252/0x4c0
    ksys_mmap_pgoff+0xf8/0x120
    __x64_sys_mmap+0x12a/0x190
    do_syscall_64+0xa9/0x580
    entry_SYSCALL_64_after_hwframe+0x76/0x7e

Found by syzkaller.

Fixes: 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
---
 mm/vma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/vma.c b/mm/vma.c
index be64f781a3aa..89073980de46 100644
--- a/mm/vma.c
+++ b/mm/vma.c
@@ -2781,6 +2781,8 @@ static unsigned long __mmap_region(struct file *file, unsigned long addr,
 	if (map.charged)
 		vm_unacct_memory(map.charged);
 abort_munmap:
+	if (map.file_doesnt_need_get && map.file)
+		fput(map.file);
 	vms_abort_munmap_vmas(&map.vms, &map.mas_detach);
 	return error;
 }
-- 
2.43.0

Re: [PATCH] mm/vma: fix memory leak in __mmap_region()

[Lorenzo Stoakes (Oracle)]

On Tue, Mar 31, 2026 at 12:19:06PM +0000, Sechang Lim wrote:
> commit 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare
> swaps the file") handled the success path by skipping get_file() via
> file_doesnt_need_get, but missed the error path.
>
> When /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls
> shmem_zero_setup_desc() which allocates a new shmem file to back the
> mapping. If __mmap_new_vma() subsequently fails, this replacement
> file is never fput()'d - the original is released by
> ksys_mmap_pgoff(), but nobody releases the new one.
>
> Add fput() for the swapped file in the error path.
>
> Reproducible with fault injection.
>
> FAULT_INJECTION: forcing a failure.
> name failslab, interval 1, probability 0, space 0, times 1
> CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full)
> Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x164/0x1f0
>  should_fail_ex+0x525/0x650
>  should_failslab+0xdf/0x140
>  kmem_cache_alloc_noprof+0x78/0x630
>  vm_area_alloc+0x24/0x160
>  __mmap_region+0xf6b/0x2660
>  mmap_region+0x2eb/0x3a0
>  do_mmap+0xc79/0x1240
>  vm_mmap_pgoff+0x252/0x4c0
>  ksys_mmap_pgoff+0xf8/0x120
>  __x64_sys_mmap+0x12a/0x190
>  do_syscall_64+0xa9/0x580
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
>  </TASK>
>
> kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
> BUG: memory leak
> unreferenced object 0xffff8881118aca80 (size 360):
>   comm "syz.7.14", pid 366, jiffies 4294913255
>   hex dump (first 32 bytes):
>     00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
>     ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff  .........(M.....
>   backtrace (crc db0f53bc):
>     kmem_cache_alloc_noprof+0x3ab/0x630
>     alloc_empty_file+0x5a/0x1e0
>     alloc_file_pseudo+0x135/0x220
>     __shmem_file_setup+0x274/0x42
>     shmem_zero_setup_desc+0x9c/0x170
>     mmap_zero_prepare+0x123/0x140
>     __mmap_region+0xdda/0x2660
>     mmap_region+0x2eb/0x3a0
>     do_mmap+0xc79/0x1240
>     vm_mmap_pgoff+0x252/0x4c0
>     ksys_mmap_pgoff+0xf8/0x120
>     __x64_sys_mmap+0x12a/0x190
>     do_syscall_64+0xa9/0x580
>     entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> Found by syzkaller.

Which syzkaller, a private implementation?

>
> Fixes: 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file")

Probably don't need a cc: stable as we're at -rc6 and this is from 6.19.

> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>

Logic looks correct to me, so:

Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>

But please adjust the logic as per the below and maybe respin for ease, where
you can add my tag also.

Thanks, Lorenzo

> ---
>  mm/vma.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/mm/vma.c b/mm/vma.c
> index be64f781a3aa..89073980de46 100644
> --- a/mm/vma.c
> +++ b/mm/vma.c
> @@ -2781,6 +2781,8 @@ static unsigned long __mmap_region(struct file *file, unsigned long addr,
>  	if (map.charged)
>  		vm_unacct_memory(map.charged);
>  abort_munmap:
> +	if (map.file_doesnt_need_get && map.file)

Let's add a comment please. It would be broken to set map.file to NULL, so we
don't need that check. Comment can be something like:

	/*
	 * This indicates that .mmap_prepare has set a new file, differing from
	 * desc->vm_file. But since we're aborting the operation, only the
	 * original file will be cleaned up. Ensure we clean up both.
	 */
	if (map.file_doesnt_need_get)
		fput(map.file);


> +		fput(map.file);


>  	vms_abort_munmap_vmas(&map.vms, &map.mas_detach);
>  	return error;
>  }
> --
> 2.43.0
>

Re: [PATCH] mm/vma: fix memory leak in __mmap_region()

[Sechang Lim]

On Tue, Mar 31, 2026 at 02:30:09PM +0100, Lorenzo Stoakes (Oracle) wrote:
> Which syzkaller, a private implementation?

Yes, a private syzkaller instance. Not the public syzbot.

> Logic looks correct to me, so:
>
> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
>
> But please adjust the logic as per the below and maybe respin for ease, where
> you can add my tag also.

Sure, will send v2 with the changes.

Thanks,
Sechang