Re: [PATCH] mm/ksm: avoid unsafe anon rmap dereference in KSM merge

[Zhao Gongyi]

Hi David and Lorenzo,

On 11/5/26 5:40 PM, David Hildenbrand wrote:
> On Mon, 02 Nov 2026 12:32:25 +0000, Lorenzo Stoakes (ARM) wrote:
>> When KSM examines candidate VMAs in scan_get_next_rmap_item(), it
>> accumulates (mm, address) pairs in ksm_rmap_item objects, assigning them
>> via get_next_rmap_item(), pinning folios via a page walk in
>> ksm_next_page_pmd_entry().
>>
>> Throughout this operation, scan_get_next_rmap_item() holds mmap read lock,
>> which it drops afterwards.
>>
>> [...]
> 
> Applied, thanks!
> 
> tree: mm/core.git
> branch: ksm-7.5.misc
> 
> Applied patches will appear soon in mm-next, followed by linux-next.
> 
> Please report any outstanding bugs that were missed during review, so we
> can either drop the patch series or decide how to fix it up.
> 
> It is encouraged to provide Acked-bys, Reviewed-bys, and Tested-bys even
> though the patches have already been applied. If possible, patch trailers
> will be updated.
> 
> Note that commit hashes shown below are subject to change due to rebase,
> trailer updates or similar. Further, this is not a guarantee that the
> patches will go upstream. If in doubt, please check the listed branch.
> 
> [1/1] mm/ksm: avoid unsafe anon rmap dereference in KSM merge
>        https://git.kernel.org/mm/core/c/d8d12d97
> 

I tested Lorenzo's posted patch on Linux 7.3.0-syz-13001714+
with CONFIG_KSM=y, CONFIG_KASAN=y and CONFIG_SLUB_RCU_DEBUG=y.

An earlier unpatched run of the fixed-pool KSM/mremap reproducer hit a
KASAN slab-use-after-free in page_address_in_vma() after about 342 seconds.
With the patch applied, the workload ran for 12 minutes (1027 KSM full
scans) without KASAN, BUG or panic. The fork/COW smoke test passed.

ksm_functional_tests reported 8 passes, 1 failure and 1 skip. The
"ptrace write failed" failure is a known test-environment issue; dmesg
showed no kernel error.

Tested-by: Zhao Gongyi <zhaogongyi@xxxxxxxxxxxxx>