fdc2316c60
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
58 lines
2.3 KiB
Diff
58 lines
2.3 KiB
Diff
From a942817e22deae157ab3431184f3a760e616f696 Mon Sep 17 00:00:00 2001
|
|
From: Rafael Aquini <raquini@redhat.com>
|
|
Date: Wed, 1 Jul 2026 16:38:58 -0400
|
|
Subject: [PATCH] procfs: fix possible double mmput() in do_procmap_query()
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-189666
|
|
CVE: CVE-2026-23199
|
|
|
|
commit 61dc9f776705d6db6847c101b98fa4f0e9eb6fa3
|
|
Author: Andrii Nakryiko <andrii@kernel.org>
|
|
Date: Tue Feb 10 11:27:38 2026 -0800
|
|
|
|
procfs: fix possible double mmput() in do_procmap_query()
|
|
|
|
When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY
|
|
we return with -ENAMETOOLONG error. After recent changes this condition
|
|
happens later, after we unlocked mmap_lock/per-VMA lock and did mmput(),
|
|
so original goto out is now wrong and will double-mmput() mm_struct. Fix
|
|
by jumping further to clean up only vm_file and name_buf.
|
|
|
|
Link: https://lkml.kernel.org/r/20260210192738.3041609-1-andrii@kernel.org
|
|
Fixes: b5cbacd7f86f ("procfs: avoid fetching build ID while holding VMA lock")
|
|
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
|
|
Reported-by: Ruikai Peng <ruikai@pwno.io>
|
|
Reported-by: Thomas Gleixner <tglx@kernel.org>
|
|
Tested-by: Thomas Gleixner <tglx@kernel.org>
|
|
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
|
|
Reported-by: syzbot+237b5b985b78c1da9600@syzkaller.appspotmail.com
|
|
Cc: Ruikai Peng <ruikai@pwno.io>
|
|
Closes: https://lkml.kernel.org/r/CAFD3drOJANTZPuyiqMdqpiRwOKnHwv5QgMNZghCDr-WxdiHvMg@mail.gmail.com
|
|
Closes: https://lore.kernel.org/all/698aaf3c.050a0220.3b3015.0088.GAE@google.com/T/#u
|
|
Cc: <stable@vger.kernel.org>
|
|
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
|
|
Signed-off-by: Rafael Aquini <raquini@redhat.com>
|
|
|
|
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
|
|
index 27cc491..a574e8d 100644
|
|
--- a/fs/proc/task_mmu.c
|
|
+++ b/fs/proc/task_mmu.c
|
|
@@ -581,7 +581,7 @@ static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
|
|
} else {
|
|
if (karg.build_id_size < build_id_sz) {
|
|
err = -ENAMETOOLONG;
|
|
- goto out;
|
|
+ goto out_file;
|
|
}
|
|
karg.build_id_size = build_id_sz;
|
|
}
|
|
@@ -609,6 +609,7 @@ static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
|
|
out:
|
|
query_vma_teardown(mm, vma);
|
|
mmput(mm);
|
|
+out_file:
|
|
if (vm_file)
|
|
fput(vm_file);
|
|
kfree(name_buf);
|