From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id A705180726 for ; Wed, 14 Oct 2026 17:13:54 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCVqi001321; Wed, 14 Oct 2026 20:12:32 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCVqi001321 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="EulzTtvw" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCTw3001301 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 14 Oct 2026 20:12:30 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCTw3001301 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48c427421f6so547801f8f.2 for ; Wed, 14 Oct 2026 10:12:30 -0700 (PDT) X-Gm-Message-State: AFq9FYJFNWRPHit7GQAWK1qwtlAXdetT4xN7P08dNhNBpmiftQswoCbR yRft9vzs+1b4jv3kGAFGjF+LNxdz64rOOU+j0E0lTt+xyX70AebkTdwL6mr/34Jg8LkIzwuQ86y ITVhARKuB51K2Cz1JmY0iIIxIM9zo2Fff5wPZ6umPFPMvu96UYd32+Q== X-Gm-Gg: AYBFou0hhBaWQoGCMh14OddSqWh7CsrjDDwWs2Z0fiEGVSYNrWzabHaJBz5F8MI1QKD qpyL3sSY4ACJQ1S/Hu2NKAiWlZK4Itth0L0VGcP/ZlvaRc+6t07edCwes0Q9bDjzSmrniZkSlUZ vsr1HX3ATxJiNbyXMhYy0U6ERHWpl5p1kr3xvsbsChTq17WE5Edi7N++BSbyRyeojYl/Kn5IdvS Drdi1xEKLhdmTVSnU2zkKCX7/v6ABkkqKM4q9UYwSPWrfsvAPWO1xBS06e6JT1zmLlK+FZg39Sf JifX6KMa9neRDXknXFFxLmSJioDaB2flYOPXEj5O5rggBPGFMKVddsax7NooMuz+IWp9ZmvK6wG +5/w15Wy5Kfars3Skhg== X-Received: by 2002:a5d:56c3:0:b0:48a:f61d:1b03 with SMTP id ffacd0b85a97d-48dbaae5bebmr25047667f8f.47.1791997949696; Wed, 14 Oct 2026 10:12:29 -0700 (PDT) X-Received: by 2002:a5d:56c3:0:b0:48a:f61d:1b03 with SMTP id ffacd0b85a97d-48dbaae5bebmr25047621f8f.47.1791997949138; Wed, 14 Oct 2026 10:12:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791997949; cv=none; d=google.com; s=arc-20260327; b=Bqqxu6Tf43TKykgSHFF54RCSUaNUadbFFOuwLYpIg3gXTJFBOtt51tbm3e0A7dfUtz 2a6AZNnuveZsjCE608vu0Yz5vNp+xrgyE/se8XnXp7qRTSmef13wTOiREAzAtSAgk+NH wQTJ8UJF5Hdeigvtg+2Sok1VLB5BOIUuZgh7AD+MGu33qQmc5ehrHCQOd3hHEU7dbXgb VTVeG0QGrdsn7E/RgNN711zI30GmOkQ7dKVgAADN8/qqC6kuBNWwNoR8/R1emD5+T6Pg BOFvDaJkX6Pydv9yAY3rGJ0riPi5OZMiyaBEzeUD6QZcLLHEtBBOTIV7pY0sOLLQJ5Ws 4xmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=XZue/7Tr7TP8NfsN2HeYtkieHvTAxCVRvvQ4fgo8Emk=; fh=xUcS46XhSaUOWFT7CPWNuABJ4EJ7/+S5u4N+e+rlWN4=; b=JCVoy3+CVcpxUER9/oH6BjrqWxrs8a/3kElfnvXugV7qz4V4frZHgLXeXWspBvXL2o NbmRwCT+NpU5zkY3JuZwA47YHwDUA6PR4pfhgVH40cB0tTouPhCHEFfy1kR/GdlE9Xkh naf2wtSOC9VcC8zMJIwfTXuk8OFEYG8kn9UggkRYCr33bvbm61PWrUkuVvkJ8jujKuFV R714jxWSMhGRNNBxe85ZwJhhNZh9TZUyNj5npGxkyZLxUrwl+fA3vsc0vmCPeQ+RUOFY CoC74Hx3X2u4/GeSgoMaOdmaadhjJ4WvOumeZgynkxPvUI0jxM47BRrbQZkw6tc85kYj yPPw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=EulzTtvw; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48df259a28bsi474775f8f.226.2026.10.14.10.12.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 10:12:29 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=EulzTtvw; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=XZue/7Tr7TP8NfsN2HeYtkieHvTAxCVRvvQ4fgo8Emk=; b=EulzTtvwHBbokCQw/F9 TvHNNr5y3xKo0fD9am2f214S0nVfqP9Kd9caa+bEw9jShU/bDYFq3+tUHkWoWGyO6v6hfIDd5yJKB auD8jvz2tz1/u53f0Ys1m3RDx6z6dPtW+y1IYwYYM71S9J9snksaUMysk52ARo03HfubiVgaAxIoJ w4700cOwrqMwWgzXXLsMLz0P3w/zQ1lgtM3wJrmKJdjMzKt0XRl6S+JaeYtFlm6VcDlzEYu9uzMaY PH6JSkQqRkyf7ks1SL3PCEeQh7QYyqj1V0NI3fZ70oc3j+hm05UnyXh0Dqu9JxEepbJh3RDLwlaOW bItpDq3l4zioKdQ==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xH2TH-0082VK-2F; Wed, 14 Oct 2026 19:12:27 +0200 From: Konstantin Khorenko Date: Wed, 14 Oct 2026 19:12:20 +0200 MIME-Version: 1.0 Message-Id: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-1-e34cbe0d1440@virtuozzo.com> References: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-0-e34cbe0d1440@virtuozzo.com> In-Reply-To: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-0-e34cbe0d1440@virtuozzo.com> To: Pavel Tikhomirov , Andrey Drobyshev , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1496; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=NGVU8Hr775W3z9fXSQNdZLu9IS/VcdR0A7Lu7klOq/Y=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqz7f4KQNWZ+LFmR3aR87oyESXLHj6iuwObp6aH 5ln1E3ErcaJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCas+3+AAKCRBRlgpH+WFc KvskEACRqdY1WX23LzcVU++h0Z6MPlUx0gL+9wFYZct4EQwoE02avxwFcUKXT0AeC1/+B8pPWjI zri5RnIjgRepAmDzAau5IqSRs2L4yC5fIsEQrJ2FnP1Lci2oWbE7Fc3rNdDbpdRtydbCwejcNN0 rSrvRNVYs7xHBVGJz9Hwr6UboH2mH+9+8d5YK37v7ocF93JN6di4YIeHM6Kmbz6LFNi56ccyfO6 8QwMUDfhn3lvkQKIXmU2UzbpLkHlfCAaCJJk4mlUOIFklkSfZx2vJC60FBFjj1xvsNNRvG91qsd Rf+yz435Jb/HU8WlO03VKvZvhTKiCv3beM/Fv7qddT/JRKpUyPjckPxT1Rgc2y5y84QiNUx8PFD matIx1PPTEqIslVnXh8eAl+BKKMVksZ0UrdW8RvsWiesLm4RsInvKt5qzxRFMW4OSYnmTWlkIqq MdcNVjme++vZJFhTv8bKNhtTo7u5LPpKICQD/o6mK2SDqsOYBjDuOAvlP3kjyoa8dJxb17k7XmR UIMwKi13QudRBNwqBCCzAw4n4R++0E0SZl17C+/ES46eXI6un4IEeNm/G1DRlH2D2vcmj4irBA3 N3AjPd6NUYeAyN7ZpaTNLR4HEPfor28j9S55Xbm8S0CUHphQl6baBvUhTR/WnhJ3IKnwGOVjqpC hcyaKutT2X2tuPg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 1/7] oracle/mm: take a file reference when preserving a file-backed VMA X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org A private mapping of /dev/zero is anonymous for vma_is_anonymous() but keeps its vm_file, so MADV_DOEXEC accepts it. vma_dup() copies the vm_file pointer without taking a reference, and both mms drop one at teardown. Any user can do this with a binary that carries the preserved-mem-ok note: map /dev/zero privately, close the fd, mark the range and exec. The second fput() is a use-after-free of the struct file. Take the reference the way dup_mmap() does, and drop it if linking the copy fails. Fixes: 9e6d16a6c0a1 ("oracle/mm: introduce VM_EXEC_KEEP") https://virtuozzo.atlassian.net/browse/VSTOR-150232 Feature: oracle/mm: MADV_DOEXEC madvise() flag Assisted-by: LLM Signed-off-by: Konstantin Khorenko --- mm/mmap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index bc508c6bd934b..52e971aee020f 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1781,6 +1781,8 @@ int vma_dup(struct vm_area_struct *old_vma, struct mm_struct *mm) ret = anon_vma_fork(vma, old_vma); if (ret) goto fail_nomem_anon_vma_fork; + if (vma->vm_file) + get_file(vma->vm_file); /* * Clear functionality that should not carry over to the new @@ -1814,6 +1816,8 @@ int vma_dup(struct vm_area_struct *old_vma, struct mm_struct *mm) return ret; fail_nomem_vma_link: + if (vma->vm_file) + fput(vma->vm_file); unlink_anon_vmas(vma); fail_nomem_anon_vma_fork: mpol_put(vma_policy(vma)); -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel