Re: [PATCH mm-unstable 1/2] mm/mmap: fix Use-After-Free of vma_iterator in dup_mmap() error path

[Lorenzo Stoakes (Oracle)]

On Wed, Mar 04, 2026 at 03:00:56PM +0800, Hui Zhu wrote:
> From: Hui Zhu <zhuhui@xxxxxxxxxx>
>
> When dup_mmap() fails during the process of duplicating VMAs,
> it jumps to the 'loop_out' label to clean up resources.
> The current implementation calls vma_iter_free(&vmi) at the
> beginning of this cleanup path.
>
> The error handling logic still needs to use the 'vmi' to traverse
> and tear down the partially initialized maple tree for the new mm.
> Since vma_iter_free() calls mas_destroy(), this results in a
> Use-After-Free (UAF).

No it wouldn't be a UAF, vma_iter_free() calls mas_destroy() which simply
frees any allocations associated with the iterator, so it's fine.

The use of the VMA iterator in the else loop doesn't allocate anything as it's
not setting anything so it's fine.

>
> This patch fixes the UAF by moving the vma_iter_free() call to the
> end of the cleanup block, ensuring the iterator remains valid
> throughout the entire rollback process.
>
> Signed-off-by: Hui Zhu <zhuhui@xxxxxxxxxx>

So yeah this patch isn't necessary and suggests a UAF that doesn't exist.

Let's keep the code as it is.

Thanks, Lorenzo

> ---
>  mm/mmap.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/mm/mmap.c b/mm/mmap.c
> index 843160946aa5..498c88a54a36 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -1848,8 +1848,8 @@ __latent_entropy int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
>  	/* a new mm has just been created */
>  	retval = arch_dup_mmap(oldmm, mm);
>  loop_out:
> -	vma_iter_free(&vmi);
>  	if (!retval) {
> +		vma_iter_free(&vmi);
>  		mt_set_in_rcu(vmi.mas.tree);
>  		ksm_fork(mm, oldmm);
>  		khugepaged_fork(mm, oldmm);
> @@ -1893,6 +1893,7 @@ __latent_entropy int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
>  			charge = tear_down_vmas(mm, &vmi, tmp, end);
>  			vm_unacct_memory(charge);
>  		}
> +		vma_iter_free(&vmi);
>  		__mt_destroy(&mm->mm_mt);
>  		/*
>  		 * The mm_struct is going to exit, but the locks will be dropped
> --
> 2.43.0
>