Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] mm: NULL pointer dereference in compat_vma_mmap() error and success paths --
commit ed2cb69a22a3cc12d20a6c5599880de22d11566c Author: Lorenzo Stoakes (ARM) <[email protected]> mm/vma: fix mmap_prepare file handling, remove file_doesnt_need_get The map->file_doesnt_need_get flag is confusing and the existing implementation has holes. [ ... ] > diff --git a/mm/util.c b/mm/util.c > index bf0513d1d3d08..016932780925e 100644 > --- a/mm/util.c > +++ b/mm/util.c > @@ -1228,8 +1228,11 @@ int __compat_vma_mmap(struct vm_area_desc *desc, > > /* Perform any preparatory tasks for mmap action. */ > err = mmap_action_prepare(desc); > - if (err) > + if (err) { > + if (desc->vm_file != vma->vm_file) > + fput(desc->vm_file); [Severity: High] Is it possible for desc->vm_file to be NULL here? If a stacked driver's mmap_prepare() hook changes the mapping to anonymous (clearing desc->vm_file to NULL) and mmap_action_prepare() fails, this error path would call fput(desc->vm_file) passing NULL. Because fput() does not tolerate NULL pointers, would this lead to a NULL pointer dereference? > return err; > + } > /* Update the VMA from the descriptor. */ > compat_set_vma_from_desc(vma, desc); > /* Complete any specified mmap actions. */ [ ... ] > diff --git a/mm/vma.h b/mm/vma.h > index e97bd2dfa786d..f15faa83f3d63 100644 > --- a/mm/vma.h > +++ b/mm/vma.h > @@ -394,8 +394,10 @@ static inline void compat_set_vma_from_desc(struct > vm_area_struct *vma, > > /* Mutable fields. Populated with initial state. */ > vma_set_pgoff(vma, desc->pgoff); > - if (desc->vm_file != vma->vm_file) > - vma_set_file(vma, desc->vm_file); > + if (desc->vm_file != vma->vm_file) { > + fput(vma->vm_file); [Severity: High] Similarly, could vma->vm_file be NULL here? If __compat_vma_mmap() is invoked on an initially anonymous VMA (where vma->vm_file is NULL) and the driver provides a backing file, this success path calls fput(vma->vm_file) passing NULL. > + vma->vm_file = desc->vm_file; > + } > vma->flags = desc->vma_flags; > vma->vm_page_prot = desc->page_prot; > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260917-b4-mmap-prepare-vma-flag-sanify-v3-0-4583d8a23...@kernel.org?part=1
