Re: [PATCH -next] mm/memory: fix null pointer dereference in fault_dirty_shared_page

[David Hildenbrand <david@redhat.com>]

On 07.07.25 13:14, Lorenzo Stoakes wrote:
> On Mon, Jul 07, 2025 at 10:51:18AM +0000, Yuntao Liu wrote:
>> Page mapping with "VM_READ|VM_WRITE|VM_MAYREAD|VM_MAYWRITE|VM_SHARED",
>> the first time accessing this address through a write operation will
>> trigger a do_shared_fault, if mapping is anonymous, it can lead to a
>> null pointer dereference.
> 
> How can it be anonymous with VM_SHARED set? This would be a far, far bigger
> bug.
> 
>>
>> [   23.232336][  T195] Call trace:
>> [   23.232542][  T195]  file_update_time+0x2c/0xd8
>> [   23.232801][  T195]  fault_dirty_shared_page+0x1a0/0x220
>> [   23.233099][  T195]  do_shared_fault+0xe8/0x240
>> [   23.233374][  T195]  do_fault+0x78/0x240
>> [   23.233629][  T195]  handle_pte_fault+0x1f0/0x3f0
>> [   23.233905][  T195]  __handle_mm_fault+0x2b0/0x548
>> [   23.234186][  T195]  handle_mm_fault+0xd4/0x2f8
>> [   23.234462][  T195]  do_page_fault+0x2f0/0x5f8
>> [   23.234727][  T195]  do_translation_fault+0x8c/0xc8
>> [   23.235021][  T195]  do_mem_abort+0x68/0x100
>> [   23.235283][  T195]  el0_da+0x4c/0x1a8
>> [   23.235551][  T195]  el0t_64_sync_handler+0xe4/0x158
>> [   23.235861][  T195]  el0t_64_sync+0x37c/0x380
> 
> How have you obtained this? Are you somehow injecting invalid state here?
> 
>>
>> Signed-off-by: Yuntao Liu <liuyuntao12@huawei.com>
>> ---
>>   mm/memory.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/mm/memory.c b/mm/memory.c
>> index eaf98d518289..8106ef8a5036 100644
>> --- a/mm/memory.c
>> +++ b/mm/memory.c
>> @@ -3412,7 +3412,7 @@ static vm_fault_t fault_dirty_shared_page(struct vm_fault *vmf)
>>   	mapping = folio_raw_mapping(folio);
>>   	folio_unlock(folio);
>>
>> -	if (!page_mkwrite)
>> +	if (!page_mkwrite && vma->vm_file)
> 
> The function is ltierally fault_dirty_shared_page(), how are we arriving
> here with !vma->vm_file?

IIRC, MAP_ANON |MAP_SHARED would have done a shmem_zero_setup().

mm/mmap.c still has the comment "mmap_region() will call 
shmem_zero_setup() to create a file".

I think this was moved to __mmap_new_vma().

Is there any (error) path where we could not call that by accident?

-- 
Cheers,

David / dhildenb