[PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[Seth Jenkins]

Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value
seq_file") introduced a null-deref if there are no vma's in the task in
show_smaps_rollup.

Fixes: 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file")
Signed-off-by: Seth Jenkins <sethjenkins@google.com>
Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
---
c4c84f06285e on upstream resolves this issue, but a fix must still be applied to stable trees 4.19-5.19.

 fs/proc/task_mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 4e0023643f8b..1e7bbc0873a4 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -969,7 +969,7 @@ static int show_smaps_rollup(struct seq_file *m, void *v)
 		vma = vma->vm_next;
 	}
 
-	show_vma_header_prefix(m, priv->mm->mmap->vm_start,
+	show_vma_header_prefix(m, priv->mm->mmap ? priv->mm->mmap->vm_start : 0,
 			       last_vma_end, 0, 0, 0, 0);
 	seq_pad(m, ' ');
 	seq_puts(m, "[rollup]\n");
-- 
2.38.0.rc1.362.ged0d419d3c-goog

Re: [PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[Greg KH]

On Wed, Oct 26, 2022 at 12:24:38PM -0400, Seth Jenkins wrote:
> Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value
> seq_file") introduced a null-deref if there are no vma's in the task in
> show_smaps_rollup.
> 
> Fixes: 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file")
> Signed-off-by: Seth Jenkins <sethjenkins@google.com>
> Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
> Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
> ---
> c4c84f06285e on upstream resolves this issue, but a fix must still be applied to stable trees 4.19-5.19.

And you need to document really really really well why we can not take
that upstream commit please.

Also note that 5.19.y is end-of-life.

Please fix up and resend.

thanks,

greg k-h

Re: [PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[Seth Jenkins]

Hi Greg,

The upstream commit that fixed the issue was not an intentional fix
AFAIK, but a refactor to switch to maple tree VMA lookups. I was under
the impression that there were no plans to backport maple trees back
to stable trees but do let me know if that presumption is incorrect.
Assuming they're not getting backported, what do you think of this
instead:
c4c84f06285e on upstream resolves this issue as part of the switch to
using maple trees for VMA lookups, but a fix must still be applied to
stable trees 4.19-5.19.

On Wed, Oct 26, 2022 at 12:41 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Wed, Oct 26, 2022 at 12:24:38PM -0400, Seth Jenkins wrote:
> > Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value
> > seq_file") introduced a null-deref if there are no vma's in the task in
> > show_smaps_rollup.
> >
> > Fixes: 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file")
> > Signed-off-by: Seth Jenkins <sethjenkins@google.com>
> > Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
> > Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
> > ---
> > c4c84f06285e on upstream resolves this issue, but a fix must still be applied to stable trees 4.19-5.19.
>
> And you need to document really really really well why we can not take
> that upstream commit please.
>
> Also note that 5.19.y is end-of-life.
>
> Please fix up and resend.
>
> thanks,
>
> greg k-h

Re: [PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[Matthew Wilcox]

On Wed, Oct 26, 2022 at 02:32:00PM -0400, Seth Jenkins wrote:
> Hi Greg,
> 
> The upstream commit that fixed the issue was not an intentional fix
> AFAIK, but a refactor to switch to maple tree VMA lookups. I was under
> the impression that there were no plans to backport maple trees back
> to stable trees but do let me know if that presumption is incorrect.

Backporting the maple tree to earlier kernels would be a giant upheaval.
I doubt it could ever be justified; certainly the need for this patch
would not be sufficient.  Not only would we have to backport the maple
tree data structure itself (which could be justified), but we'd also
have to redo the conversion of the VMAs from rbtree to maple tree.

> Assuming they're not getting backported, what do you think of this
> instead:
> c4c84f06285e on upstream resolves this issue as part of the switch to
> using maple trees for VMA lookups, but a fix must still be applied to
> stable trees 4.19-5.19.
> 
> On Wed, Oct 26, 2022 at 12:41 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > On Wed, Oct 26, 2022 at 12:24:38PM -0400, Seth Jenkins wrote:
> > > Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value
> > > seq_file") introduced a null-deref if there are no vma's in the task in
> > > show_smaps_rollup.
> > >
> > > Fixes: 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file")
> > > Signed-off-by: Seth Jenkins <sethjenkins@google.com>
> > > Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
> > > Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
> > > ---
> > > c4c84f06285e on upstream resolves this issue, but a fix must still be applied to stable trees 4.19-5.19.
> >
> > And you need to document really really really well why we can not take
> > that upstream commit please.
> >
> > Also note that 5.19.y is end-of-life.
> >
> > Please fix up and resend.
> >
> > thanks,
> >
> > greg k-h

Re: [PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[Greg KH]

A: http://en.wikipedia.org/wiki/Top_post
Q: Were do I find info about this thing called top-posting?
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?

A: No.
Q: Should I include quotations after my reply?

http://daringfireball.net/2007/07/on_top

On Wed, Oct 26, 2022 at 02:32:00PM -0400, Seth Jenkins wrote:
> Hi Greg,
> 
> The upstream commit that fixed the issue was not an intentional fix
> AFAIK, but a refactor to switch to maple tree VMA lookups. I was under
> the impression that there were no plans to backport maple trees back
> to stable trees but do let me know if that presumption is incorrect.
> Assuming they're not getting backported, what do you think of this
> instead:

Yes, as Matthew said, backporting maple trees is not a good idea, we
don't want that.

> c4c84f06285e on upstream resolves this issue as part of the switch to
> using maple trees for VMA lookups, but a fix must still be applied to
> stable trees 4.19-5.19.

That's better, yes.  Please add that and resend a new version.

thanks,

greg k-h

Re: [PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[Greg KH]

On Thu, Oct 27, 2022 at 11:36:52AM -0400, Seth Jenkins wrote:
> Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value
> seq_file") introduced a null-deref if there are no vma's in the task in
> show_smaps_rollup.
> 
> Fixes: 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file")
> Signed-off-by: Seth Jenkins <sethjenkins@google.com>
> Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
> Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
> ---
> c4c84f06285e on upstream resolves this issue as part of the switch to using
> maple trees for VMA lookups, but a fix must still be applied to stable trees
> 4.19-5.19.

Now queued up, thanks.

greg k-h

[PATCH stable 4.19-5.19] mm: /proc/pid/smaps_rollup: fix no vma's null-deref

[Seth Jenkins]

Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value
seq_file") introduced a null-deref if there are no vma's in the task in
show_smaps_rollup.

Fixes: 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file")
Signed-off-by: Seth Jenkins <sethjenkins@google.com>
Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
---
c4c84f06285e on upstream resolves this issue as part of the switch to using
maple trees for VMA lookups, but a fix must still be applied to stable trees
4.19-5.19.

 fs/proc/task_mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 4e0023643f8b..1e7bbc0873a4 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -969,7 +969,7 @@ static int show_smaps_rollup(struct seq_file *m, void *v)
 		vma = vma->vm_next;
 	}
 
-	show_vma_header_prefix(m, priv->mm->mmap->vm_start,
+	show_vma_header_prefix(m, priv->mm->mmap ? priv->mm->mmap->vm_start : 0,
 			       last_vma_end, 0, 0, 0, 0);
 	seq_pad(m, ' ');
 	seq_puts(m, "[rollup]\n");
-- 
2.38.0.rc1.362.ged0d419d3c-goog