Re: [BUG] [PATCH v2 mm-stable] procfs: avoid fetching build ID while holding VMA lock

[Andrii Nakryiko <andrii.nakryiko@gmail.com>]

On Tue, Feb 10, 2026 at 10:41 AM Thomas Gleixner <tglx@kernel.org> wrote:
>
> On Thu, Jan 29 2026 at 13:53, Andrii Nakryiko wrote:
> >       /* unlock vma or mmap_lock, and put mm_struct before copying data to user */
> >       query_vma_teardown(&lock_ctx);
> >       mmput(mm);
> >
> > +     if (karg.build_id_size) {
> > +             __u32 build_id_sz;
> > +
> > +             if (vm_file)
> > +                     err = build_id_parse_file(vm_file, build_id_buf, &build_id_sz);
> > +             else
> > +                     err = -ENOENT;
> > +             if (err) {
> > +                     karg.build_id_size = 0;
> > +             } else {
> > +                     if (karg.build_id_size < build_id_sz) {
> > +                             err = -ENAMETOOLONG;
> > +                             goto out;
>
> Introduces a double mmput() here.
>
> > +                     }
> > +                     karg.build_id_size = build_id_sz;
> > +             }
> > +     }
> > +
> > +     if (vm_file)
> > +             fput(vm_file);
> > +
> >       if (karg.vma_name_size && copy_to_user(u64_to_user_ptr(karg.vma_name_addr),
> >                                              name, karg.vma_name_size)) {
> >               kfree(name_buf);
> > @@ -798,6 +808,8 @@ static int do_procmap_query(struct mm_struct *mm, void __user *uarg)
> >  out:
> >       query_vma_teardown(&lock_ctx);
> >       mmput(mm);
> > +     if (vm_file)
> > +             fput(vm_file);
> >       kfree(name_buf);
> >       return err;
>
> See:
>
>         https://lore.kernel.org/all/698aaf3c.050a0220.3b3015.0088.GAE@google.com/T/#u
>

Ah, silly mistake on my part, thanks for the heads up, I'll send a fix shortly

> Thanks
>
>         tglx