Re: [PATCH bpf-next v3 3/7] exec: Clear bprm->mm before dropping its reference

[bot+bpf-ci]

> commit d3633d366b08f6123fe20f3fd64fd2a8c5f6a5af
> Author: Anastasios Papagiannis <tasos.papagiannnis@xxxxxxxxx>
> Date:   Mon Aug 31 12:23:01 2026 +0300
>
>     exec: Clear bprm->mm before dropping its reference
>
>     Once mmput() drops the final reference to bprm->mm, the pointer must no
>     longer remain accessible through struct linux_binprm.
>
>     The successful exec path and the bprm initialization error path already
>     clear bprm->mm when ownership is transferred or released. Do the same in
>     free_bprm() before calling mmput().
>
>     This is required for eBPF kfuncs where bprm->mm is either NULL or points
>     to a live mm_struct to ensure safe access.
>
>     Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@xxxxxxxxx>

This looks like a bug fix. Should this include a Fixes: tag?

The dangling pointer bug was introduced when eBPF kfuncs were added that
access bprm->mm. At that point, bprm->mm needed to be either NULL or
point to valid memory, but free_bprm() wasn't updated to clear bprm->mm
before calling mmput().

Suggested:

  Fixes: ef5769fc8b1e ("bpf: Add user memory access kfuncs for mm_struct")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33379004067