Re: [BUG] page table UAF, Re: [PATCH v8 14/21] mm/mmap: Avoid zeroing vma tree in mmap_region()

[Jann Horn]

On Tue, Oct 8, 2024 at 7:52 PM Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
> On Tue, Oct 8, 2024 at 10:16 AM Jann Horn <jannh@xxxxxxxxxx> wrote:
> > Is that code in a tree somewhere?
> >
> > What locking will those RCU walkers use when accessing VMAs? I guess
> > they probably anyway have to take the VMA locks to ensure they see
> > consistent state, though I guess with enough effort you could avoid it
> > (seqlock-style) on some fastpaths when the vma is not concurrently
> > modified and the fastpath doesn't need access to the VMA's file?
>
> Sorry, it's not posted upstream yet but yes, the idea is to walk the
> tree under RCU and detect concurrent changes using seq-counters. A
> prototype was posted here:
> https://lore.kernel.org/all/20240123231014.3801041-3-surenb@xxxxxxxxxx/
> but it had some issues I'm yet to resolve.

Ah, thanks for the pointer.