Re: [PATCH] mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge

[Lorenzo Stoakes]

On Mon, Jan 05, 2026 at 10:24:13AM -0500, Liam R. Howlett wrote:
> >                                       mremap()
> >                      |-----------------------------------|
> >                      |                                   |
> >                      v                                   |
> > [ VMA C, unfaulted ][ gap ][ VMA B, unfaulted ][ gap ][ VMA A, faulted ]
>
> The key part here is that target == prev in this case (as stated in the
> email linked).  So we're going to dup nothing, but we really need to dup
> VMA A's anon vma - right?

Yup.

There are a number other cases like this, mremap() of anon breaks things,
because the copy_vma() case violates sensible assumptions, in the way anon
mremap() violates many other sensible assumptions.

I have a generalised fix I'm just finishing up the tests for it now.

You'll see exactly which cases in the v2 which I'll send later today.

I also noticed another issue which I'll fix in the same series...

Happy New Year! ;)