Re: [syzbot] [mm?] KASAN: slab-use-after-free Read in __vma_reservation_common

[Hillf Danton]

On Sat, 13 Apr 2024 11:34:32 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    9ed46da14b9b Add linux-next specific files for 20240412
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=12bd4457180000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=7ea0abc478c49859
> dashboard link: https://syzkaller.appspot.com/bug?extid=ad1b592fc4483655438b
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1370ea67180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  9ed46da14b9b

--- x/mm/mmap.c
+++ y/mm/mmap.c
@@ -2657,8 +2657,6 @@ do_vmi_align_munmap(struct vma_iterator
 	/* Point of no return */
 	mm->locked_vm -= locked_vm;
 	mm->map_count -= count;
-	if (unlock)
-		mmap_write_downgrade(mm);
 
 	prev = vma_iter_prev_range(vmi);
 	next = vma_next(vmi);
@@ -2677,7 +2675,7 @@ do_vmi_align_munmap(struct vma_iterator
 	remove_mt(mm, &mas_detach);
 	validate_mm(mm);
 	if (unlock)
-		mmap_read_unlock(mm);
+		mmap_write_unlock(mm);
 
 	__mt_destroy(&mt_detach);
 	return 0;
--