Re: [PATCH] mm/madvise: handle madvise_lock() failure during race unwinding

[Jann Horn <jannh@google.com>]

On Mon, Jun 2, 2025 at 9:28 PM Lorenzo Stoakes
<lorenzo.stoakes@oracle.com> wrote:
> On Mon, Jun 02, 2025 at 09:20:14PM +0200, Jann Horn wrote:
> > @akpm FYI, this looks like it fixes a security bug in 6.15 (probably
> > leads to UAF of VMA structs and page tables by racing madvise(...,
> > MADV_GUARD_INSTALL) with concurrent faults)
>
> Hmm MADV_GUARD_INSTALL / MADV_GUARD_REMOVE require only a read lock, so
> madvise_lock() will be:
>
>
>         if (madvise_need_mmap_write(behavior)) { <--- nope
>                 if (mmap_write_lock_killable(mm))
>                         return -EINTR;
>         } else {
>                 mmap_read_lock(mm); <---- this branch
>         }
>         return 0;
>
> So for guard install, which is the only thing that can return -ERESTARTNOINTR
> madvise_lock() ignoring the return value is essentially a no-op no?
>
> Am I missing something?

... you're right, of course. please ignore my needlessly alarmist comment.

(I think it is surprising that the write lock is killable while the
read lock isn't but that's another story)